832a5d7ce5e4f1300d5021a83e538c3155532e6241d170dc9497110102018cf5

General

Target

832a5d7ce5e4f1300d5021a83e538c3155532e6241d170dc9497110102018cf5
Size

36KB
MD5

a32bc3bf074df51cebe1bd7811124ec0
SHA1

64b1fb4c35690df4bcb70180214a2e9a6de448b2
SHA256

832a5d7ce5e4f1300d5021a83e538c3155532e6241d170dc9497110102018cf5
SHA512

397ab7e1554122443c56e29cb484fb34a30ebdaa3d681c127b9fa62059b489028356ab6cbb1e9613ae82b515f796f084737f994970e39ebbdc1082e97395d06f
SSDEEP

768:kSwPxoGYb5et2oZCvgyeVyBfcnTg8L0Nb+EVoI/u2Twa6bDvIt:t6gletPEvgyeUKcVtvyI22TwTvq

Score

N/A

Malware Config

Signatures

Files

832a5d7ce5e4f1300d5021a83e538c3155532e6241d170dc9497110102018cf5
.exe windows x86

66e26ce4c87fcc25711b6ae38b998928

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoStartNextPacket
IoReleaseCancelSpinLock
KeRemoveDeviceQueue
InterlockedExchange
IoAcquireCancelSpinLock
IoStartPacket
IoDeleteDevice
KeSetTimer
InterlockedIncrement
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
MmPageEntireDriver
KeInitializeEvent
KeInitializeTimer
KeInitializeDpc
PsSetLoadImageNotifyRoutine
KeRemoveEntryDeviceQueue
IoCreateDevice
ExReleaseResourceLite
ExFreePool
ZwClose
ZwWriteFile
ExAllocatePoolWithTag
ZwCreateFile
ExAcquireResourceExclusiveLite
RtlInitUnicodeString
ZwSetValueKey
ZwCreateKey
ZwDeleteValueKey
tolower
RtlFreeAnsiString
ZwTerminateProcess
ZwOpenProcess
RtlInitAnsiString
RtlUnicodeStringToAnsiString
KeCancelTimer
MmUnlockPagableImageSection
MmLockPagableDataSection
IofCompleteRequest
ZwQuerySystemInformation
InterlockedDecrement

hal

KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
HalMakeBeep
KfRaiseIrql

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 826B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66e26ce4c87fcc25711b6ae38b998928

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 6KB

.data Size: 25KB - Virtual size: 25KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 1024B - Virtual size: 826B

.text
Size: 6KB - Virtual size: 6KB

.data
Size: 25KB - Virtual size: 25KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 1024B - Virtual size: 826B