1334d4b7a2ac73b2e6c19707a3bc424d7e7fd360a2dafd126ee533bb6b8ae9b1

General

Target

1334d4b7a2ac73b2e6c19707a3bc424d7e7fd360a2dafd126ee533bb6b8ae9b1
Size

6KB
MD5

a2ddf20c533fc6fc95c4e65a78cd8bd0
SHA1

aaf642b8bca8316ecb1eb7ddbe4473040cf6d306
SHA256

1334d4b7a2ac73b2e6c19707a3bc424d7e7fd360a2dafd126ee533bb6b8ae9b1
SHA512

55c3d3b5bd0411eb17fad6dc856035e281cce21931d2d0ebad9b8ab524dec6d9c7f1b81d75d3fb0491770d56567fc91646012c4aa45440d69de85bba66eabacc
SSDEEP

96:4ztcAvCvGGrS4X+b9Fe5S45YFUrVsP4quXBwXNT4NS/igRw6AKtMzm68Oz:4ztcVGYuGY2rV841wsKlbT6Hz

Score

N/A

Malware Config

Signatures

Files

1334d4b7a2ac73b2e6c19707a3bc424d7e7fd360a2dafd126ee533bb6b8ae9b1
.exe windows x86

bb987107c12db4043bce620809ac5191

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
ObOpenObjectByPointer
_except_handler3
IoCreateFile
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmUnmapViewOfSection
ZwClose
ZwSetValueKey
wcslen
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwCreateKey
RtlInitAnsiString
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IofCompleteRequest
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
PsLookupProcessByProcessId

hal

KeGetCurrentIrql

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 419B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 354B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb987107c12db4043bce620809ac5191

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 419B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 384B - Virtual size: 354B

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 419B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 384B - Virtual size: 354B