c8411c346db7738ea79fc8e699a897878147c0481c5a9ad947a83607ee73e28f

General

Target

c8411c346db7738ea79fc8e699a897878147c0481c5a9ad947a83607ee73e28f
Size

72KB
MD5

82aa265b32f07234d25d82400c7db889
SHA1

0d130a2e92d57496bcf4ca7137c69bdbc9a1497d
SHA256

c8411c346db7738ea79fc8e699a897878147c0481c5a9ad947a83607ee73e28f
SHA512

ddc985ab018d211cb542a346b719c040ac50c3d1634a59051253ba19541b9aad2fc9a363e8ee36508b013e91863746abfbe3092e9a9eea914d4f994702cf94c1
SSDEEP

1536:dz4c+v6VN6aVuZJMBnZCyYmmDKYxbauU+4n2t8LPuXO3O:dozR4BZyHDKYpaz+4M8rHe

Score

N/A

Malware Config

Signatures

Files

c8411c346db7738ea79fc8e699a897878147c0481c5a9ad947a83607ee73e28f
.exe windows x86

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTagPriority
IoReleaseCancelSpinLock
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
WmiTraceMessage
IofCompleteRequest
RtlLargeIntegerNegate
ProbeForRead
IoCheckShareAccess
wcslen
ObfDereferenceObject
_except_handler3
ObReferenceObjectByHandle
IoAcquireCancelSpinLock
RtlCompareMemory
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ExRaiseStatus
ExRaiseAccessViolation
MmUserProbeAddress
_purecall
IoSetShareAccess
IoGetRequestorProcess
IoFreeWorkItem
IoAllocateWorkItem
KeAttachProcess
KeDetachProcess
IoGetCurrentProcess
ZwDeleteFile
RtlInitUnicodeString
swprintf
ZwCreateFile
ZwClose
ZwReadFile
ZwWriteFile
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
ObCloseHandle
KeInitializeEvent
WmiQueryTraceInformation
IoWMIRegistrationControl
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoQueueWorkItem
_allmul
_alldiv
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
IoRemoveShareAccess
KeSetTimer
KeCancelTimer
KeInitializeDpc
KeInitializeTimer
KeTickCount
KeBugCheckEx

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 15KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 210B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 15KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 210B