f033881a7f890a8ad50dee5364d38b9665aea5339a3a8406da0055bf23c41ace

Sharing

Copy URL Twitter E-mail

General

Target

f033881a7f890a8ad50dee5364d38b9665aea5339a3a8406da0055bf23c41ace
Size

20KB
MD5

a29829ea41766dbe5a212fb1da404f9f
SHA1

5d355f5232910364d3617bef66220725a914ef1e
SHA256

f033881a7f890a8ad50dee5364d38b9665aea5339a3a8406da0055bf23c41ace
SHA512

a7ff4766ab79a2067c36507c4f84cf16335741753c638e5a87f07cfc671462d1dfc6e6d6015e8fdbe7c4425fedea8cc0a5321eb3a4b7ffb88c56e1a9dd63eeec
SSDEEP

384:ez+uPDXemFgon4MKM4sIamFt3N65YSAveeCOmkNlYF8eO18N4PKRypr47HS9Wf9Z:G+i5pn4Mzv6urB

Score

N/A

Malware Config

Signatures

Files

f033881a7f890a8ad50dee5364d38b9665aea5339a3a8406da0055bf23c41ace
.exe windows x86

01b18e29fdb3b7e169beabf3200085cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ZwClose
IoFileObjectType
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
strncmp
IoGetCurrentProcess
_strlwr
_strupr
strrchr
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
_stricmp
ObReferenceObjectByHandle
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

jJfbuH
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 864B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t5ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t4ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t2ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 852B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01b18e29fdb3b7e169beabf3200085cc

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

jJfbuH Size: 4KB - Virtual size: 4KB

.rdata Size: 864B - Virtual size: 840B

.data Size: 8KB - Virtual size: 8KB

.t5ata Size: 256B - Virtual size: 256B

.t4ata Size: 256B - Virtual size: 256B

.t3ata Size: 256B - Virtual size: 256B

.t2ata Size: 256B - Virtual size: 256B

.t1ata Size: 512B - Virtual size: 512B

.rata Size: 2KB - Virtual size: 2KB

INIT Size: 864B - Virtual size: 852B

.reloc Size: 608B - Virtual size: 606B

jJfbuH
Size: 4KB - Virtual size: 4KB

.rdata
Size: 864B - Virtual size: 840B

.data
Size: 8KB - Virtual size: 8KB

.t5ata
Size: 256B - Virtual size: 256B

.t4ata
Size: 256B - Virtual size: 256B

.t3ata
Size: 256B - Virtual size: 256B

.t2ata
Size: 256B - Virtual size: 256B

.t1ata
Size: 512B - Virtual size: 512B

.rata
Size: 2KB - Virtual size: 2KB

INIT
Size: 864B - Virtual size: 852B

.reloc
Size: 608B - Virtual size: 606B