96953153bb6e89cf300c9e371d4bdd999024f079d46fb724acb390b5bab27cb8

General

Target

96953153bb6e89cf300c9e371d4bdd999024f079d46fb724acb390b5bab27cb8
Size

65KB
MD5

a17fe033ce6d23616a71608e64b81ae4
SHA1

c46ae509694128173e586ce00accbc534f8ce943
SHA256

96953153bb6e89cf300c9e371d4bdd999024f079d46fb724acb390b5bab27cb8
SHA512

e9638a704f1b98b9ef551806c6fdd6b59b5ab498c4cbd1898b20f40d60453f48aada1ed9f36639d57fad163ea0b8d49873376c08cbbb381629ec419b9f49c1ab
SSDEEP

1536:Bz4c+v6VN6aVuZJMBnZCyYmmDKYxbauU+4ntw9u/:BozR4BZyHDKYpaz+4tw9i

Score

N/A

Malware Config

Signatures

Files

96953153bb6e89cf300c9e371d4bdd999024f079d46fb724acb390b5bab27cb8
.exe windows x86

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTagPriority
IoReleaseCancelSpinLock
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
WmiTraceMessage
IofCompleteRequest
RtlLargeIntegerNegate
ProbeForRead
IoCheckShareAccess
wcslen
ObfDereferenceObject
_except_handler3
ObReferenceObjectByHandle
IoAcquireCancelSpinLock
RtlCompareMemory
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ExRaiseStatus
ExRaiseAccessViolation
MmUserProbeAddress
_purecall
IoSetShareAccess
IoGetRequestorProcess
IoFreeWorkItem
IoAllocateWorkItem
KeAttachProcess
KeDetachProcess
IoGetCurrentProcess
ZwDeleteFile
RtlInitUnicodeString
swprintf
ZwCreateFile
ZwClose
ZwReadFile
ZwWriteFile
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
ObCloseHandle
KeInitializeEvent
WmiQueryTraceInformation
IoWMIRegistrationControl
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoQueueWorkItem
_allmul
_alldiv
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
IoRemoveShareAccess
KeSetTimer
KeCancelTimer
KeInitializeDpc
KeInitializeTimer
KeTickCount
KeBugCheckEx

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74b1625af48d135253d954a974ad06e5

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 15KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 210B

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 15KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 210B