11ffb6e7d12d5070694e19174cb3dd777fa373e3af609802781c3300c29ede6d

General

Target

11ffb6e7d12d5070694e19174cb3dd777fa373e3af609802781c3300c29ede6d
Size

18KB
MD5

92b8f2f6fc2481b5fef33e10c681d5e6
SHA1

686b7dd559d6cf024f43e3790fdb83a3f1d42fb2
SHA256

11ffb6e7d12d5070694e19174cb3dd777fa373e3af609802781c3300c29ede6d
SHA512

899c619f14668e13f8db47616e9e8a458927524d33da7f2333b05cd6ca4daa5c58654a3cea9aac5e34d2a1b0e76c2561d54ae593f108c33a74704d97397c5462
SSDEEP

384:/s+sKIttp+v0Aui2eMwHbZ7wvyyShEwkwUqXLKnyYMDuT2pQH0PBGzPqteX119Bi:E+B6thdv6urwp0W

Score

N/A

Malware Config

Signatures

Files

11ffb6e7d12d5070694e19174cb3dd777fa373e3af609802781c3300c29ede6d
.exe windows x86

e24346064d37401a267984021d2bfdf6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateSymbolicLink
RtlFreeUnicodeString
ZwQuerySystemInformation
RtlInitUnicodeString
MmUserProbeAddress
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwQueryInformationProcess
ZwPulseEvent
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
_strupr
_strlwr
strrchr
ZwClose
IofCompleteRequest
_stricmp
IoCreateDevice
_except_handler3

hal

KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KeQueryPerformanceCounter

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 864B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 634B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e24346064d37401a267984021d2bfdf6

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 864B - Virtual size: 864B

.data Size: 7KB - Virtual size: 7KB

.rata Size: 2KB - Virtual size: 2KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 634B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 864B - Virtual size: 864B

.data
Size: 7KB - Virtual size: 7KB

.rata
Size: 2KB - Virtual size: 2KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 634B