91267e1ff0642d8bab97cbdd898152a623b4fef46b95c5f45978339828b5f526

General

Target

91267e1ff0642d8bab97cbdd898152a623b4fef46b95c5f45978339828b5f526
Size

18KB
MD5

023d2886a1f6d5d40330f043cf0e02f4
SHA1

9a4047ca7c58d32d63640fb401d9af73f9805bf3
SHA256

91267e1ff0642d8bab97cbdd898152a623b4fef46b95c5f45978339828b5f526
SHA512

e0a4f0375d692979871f550e714976162a0428adf91abaefe8b0b3e774c95ad2890c78ab33bfb85a9f4697d1b6250752a7d97c747dbac415031ab388029039eb
SSDEEP

384:wJ9v3EyuvymGtyShEwkwUqXLKnyYMepQH0PBGZui2eMwHbZ7wvVF4N09z3b71+7c:wTCGy+UV76U

Score

N/A

Malware Config

Signatures

Files

91267e1ff0642d8bab97cbdd898152a623b4fef46b95c5f45978339828b5f526
.exe windows x86

e890af971ff32086787261dce5e980ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ProbeForRead
_except_handler3
_stricmp
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ProbeForWrite
ExAllocatePoolWithTag
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
ZwQueryInformationProcess
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
PsTerminateSystemThread
MmIsAddressValid
ExFreePool
ExGetPreviousMode

hal

KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zcata
Size: 544B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

vcata
Size: 544B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 992B - Virtual size: 992B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 378B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e890af971ff32086787261dce5e980ff

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 15KB - Virtual size: 15KB

zcata Size: 544B - Virtual size: 520B

vcata Size: 544B - Virtual size: 520B

INIT Size: 992B - Virtual size: 992B

.reloc Size: 384B - Virtual size: 378B

.text
Size: 15KB - Virtual size: 15KB

zcata
Size: 544B - Virtual size: 520B

vcata
Size: 544B - Virtual size: 520B

INIT
Size: 992B - Virtual size: 992B

.reloc
Size: 384B - Virtual size: 378B