6de3d3f6ecb1c517ed327552cf3e3f6ffd87dde9e1a9e02e7b000a6516cebf73

General

Target

6de3d3f6ecb1c517ed327552cf3e3f6ffd87dde9e1a9e02e7b000a6516cebf73
Size

159KB
MD5

90eeb12eeb355e247b258802ec230ea3
SHA1

75135e7a47eb42e34879b73cc4026d3d0afe05ba
SHA256

6de3d3f6ecb1c517ed327552cf3e3f6ffd87dde9e1a9e02e7b000a6516cebf73
SHA512

65a2ba0651f2a4b75da604de52caefd13abf8737f140c04709d55e2ad4153b3f5df47a48c438e720f0cf2902a01149c55b368fe9d9cfdda8246a34179001530e
SSDEEP

3072:k8MsqePAuGjCRUnbqzxOpyveIn0C2cJaJFs0r9gkJKqDm+TAnBRjvt:k9sRAuGjxnmzwA0C2ckJ4f+iBRjv

Score

N/A

Malware Config

Signatures

Files

6de3d3f6ecb1c517ed327552cf3e3f6ffd87dde9e1a9e02e7b000a6516cebf73
.exe windows x86

f3031cd86e03e86d32da70d25ca44c1d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KfReleaseSpinLock
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock

ntoskrnl.exe

ZwClose
RtlQueryRegistryValues
ZwCreateKey
RtlInitUnicodeString
IoOpenDeviceRegistryKey
ZwOpenKey
IoFreeIrp
RtlInitializeSid
RtlCompareMemory
IoStopTimer
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeQueryTimeIncrement
KeQuerySystemTime
_allmul
IofCallDriver
KeInitializeEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IoFreeWorkItem
ObfDereferenceObject
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
KeInitializeMutex
IoAllocateIrp
IoQueueWorkItem
IoAllocateWorkItem
IoStartTimer
IoInitializeTimer
KeSetEvent
IoGetDriverObjectExtension
_allshl
IoStartNextPacket
MmUnlockPages
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
KeInitializeSpinLock
IoInitializeIrp
KefReleaseSpinLockFromDpcLevel
KeBugCheckEx
KeWaitForSingleObject
KeGetCurrentThread
KeSetTimerEx
KeTickCount
IoGetDeviceProperty
IoStartPacket
IoSetHardErrorOrVerifyDevice
ObReferenceObjectByPointer
MmProbeAndLockPages
_alldvrm
IoDeleteDevice
IoDetachDevice
IoInvalidateDeviceRelations
IoWMIRegistrationControl

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3031cd86e03e86d32da70d25ca44c1d

Headers

File Characteristics

Imports

hal

ntoskrnl.exe

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 16KB

.INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 244B

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 16KB

.INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 244B