97c343398e691c4f0318b988da67027a3478db72d147fd17bb9073cac12af528

General

Target

97c343398e691c4f0318b988da67027a3478db72d147fd17bb9073cac12af528
Size

186KB
MD5

57ed6a0b7031ed1e37efdd638a588c00
SHA1

31ab8140d369b7523aed10de0968b02a50eedfef
SHA256

97c343398e691c4f0318b988da67027a3478db72d147fd17bb9073cac12af528
SHA512

105c883d1d6cf297b20d4d32ca362a290135dc7d8f634c2485927c409da7c91e58405c67fe3357f5b64889d04c33d2172189295a9c3c15179aea3e40be1efdc8
SSDEEP

3072:B2XVPQrrIJmVJ6c9RWVLSvlc+J2o/Rp7CsVa:hrrfCc/Wovy02om0a

Score

N/A

Malware Config

Signatures

Files

97c343398e691c4f0318b988da67027a3478db72d147fd17bb9073cac12af528
.exe windows x86

a0986d25a38ab330cf168e3c95001820

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitAnsiString
ExFreePool
ZwClose
RtlInitUnicodeString
IofCompleteRequest
ZwOpenKey
ZwCreateKey
memmove
ZwQueryValueKey
RtlAppendUnicodeStringToString
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
ObfDereferenceObject
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
ExAllocatePoolWithTag
RtlIntegerToUnicodeString
IoGetDeviceObjectPointer
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 32B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.STL
Size: 32B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 928B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0986d25a38ab330cf168e3c95001820

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 4KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 1KB

.CRT Size: 32B - Virtual size: 12B

.STL Size: 32B - Virtual size: 16B

PAGE Size: 2KB - Virtual size: 2KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 896B - Virtual size: 888B

.reloc Size: 928B - Virtual size: 920B

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 1KB

.CRT
Size: 32B - Virtual size: 12B

.STL
Size: 32B - Virtual size: 16B

PAGE
Size: 2KB - Virtual size: 2KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 896B - Virtual size: 888B

.reloc
Size: 928B - Virtual size: 920B