8e6982d99a0a8fd3ac639f687af0a0c89d1518db551b31fc6449ef4a61f28b89

Sharing

Copy URL Twitter E-mail

General

Target

8e6982d99a0a8fd3ac639f687af0a0c89d1518db551b31fc6449ef4a61f28b89
Size

41KB
MD5

a182ab7bbee0572729cc79b763be4598
SHA1

97d6747ef22a70f18c315b01dacb943fde130495
SHA256

8e6982d99a0a8fd3ac639f687af0a0c89d1518db551b31fc6449ef4a61f28b89
SHA512

b78cbad90054521fbdc6c63a9cd9d5b458327fa232d7d2b655ce01bfb87e2314243fe468aa03d24b4bf0ec3ba0e77cf70aa477a43d36e1dd14c54556b45eb6b0
SSDEEP

768:47ya7J7SZ+7ZJikgToXJFF9SmHWLAm1bqiLL:4Oa72qZJp8xLdqif

Score

N/A

Malware Config

Signatures

Files

8e6982d99a0a8fd3ac639f687af0a0c89d1518db551b31fc6449ef4a61f28b89
.exe windows x86

a955846a0d79a230624fc6fe7490a638

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
IoDeleteDevice
IoUnregisterShutdownNotification
IoDeleteSymbolicLink
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoRegisterShutdownNotification
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
InitSafeBootMode
ExInitializeResourceLite
ExDeleteResourceLite
ExAcquireResourceSharedLite
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
KeLeaveCriticalRegion
ExReleaseResourceLite
memcpy
ZwClose
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlCompareUnicodeString
ExFreePoolWithTag
ZwWriteFile
ZwDeleteFile
PsGetVersion
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
ZwEnumerateKey
ZwDeleteKey
ZwDeleteValueKey
ZwSetInformationFile
ZwOpenFile
memset
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
KeTickCount
KeBugCheckEx
RtlUnwind
_snwprintf
ExAllocatePoolWithTag
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlFreeUnicodeString

hal

KeGetCurrentIrql

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a955846a0d79a230624fc6fe7490a638

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 1KB

PAGE Size: 5KB - Virtual size: 4KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 1024B - Virtual size: 988B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 1KB

PAGE
Size: 5KB - Virtual size: 4KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 1024B - Virtual size: 988B