1f1c0263489f9f975b4b782313ae6b4b04552b41be338e4cbb9bda97b6aac22c

Sharing

Copy URL Twitter E-mail

General

Target

1f1c0263489f9f975b4b782313ae6b4b04552b41be338e4cbb9bda97b6aac22c
Size

21KB
MD5

07bfdd2763856e117e04a5a10b18d276
SHA1

a91a65c5858c8163ea03856eeb0647b5c08a3ee8
SHA256

1f1c0263489f9f975b4b782313ae6b4b04552b41be338e4cbb9bda97b6aac22c
SHA512

37ca4bbf4390b16943cd5f013d829cc300d78a781373f20158c755f2cd3072eb9917eb5fcc5fda901e9b2ad6c42aa76b932a74afffc696bed068512f51063a4f
SSDEEP

384:j+u7tNpOJynkD+JNM4sIamFt3N65YSAveeCOmkNlYF8eO18N4PKRypr47HS9Wf9V:j+aQ0nkDOcv6urF

Score

N/A

Malware Config

Signatures

Files

1f1c0263489f9f975b4b782313ae6b4b04552b41be338e4cbb9bda97b6aac22c
.exe windows x86

89474a3157025f62db9958fd4a86b7be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
ZwClose
strncmp
IoGetCurrentProcess
_strlwr
ZwQuerySystemInformation
_strupr
strrchr
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwQueryInformationProcess
ZwPulseEvent
IofCompleteRequest
_stricmp
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

ubuWuJ
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 864B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t7ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t6ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t5ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t4ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t2ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 940B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89474a3157025f62db9958fd4a86b7be

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

ubuWuJ Size: 4KB - Virtual size: 4KB

.rdata Size: 864B - Virtual size: 856B

.data Size: 8KB - Virtual size: 8KB

.t7ata Size: 256B - Virtual size: 256B

.t6ata Size: 256B - Virtual size: 256B

.t5ata Size: 256B - Virtual size: 256B

.t4ata Size: 256B - Virtual size: 256B

.t3ata Size: 256B - Virtual size: 256B

.t2ata Size: 256B - Virtual size: 256B

.t1ata Size: 512B - Virtual size: 512B

.rata Size: 2KB - Virtual size: 2KB

INIT Size: 960B - Virtual size: 940B

.reloc Size: 640B - Virtual size: 628B

ubuWuJ
Size: 4KB - Virtual size: 4KB

.rdata
Size: 864B - Virtual size: 856B

.data
Size: 8KB - Virtual size: 8KB

.t7ata
Size: 256B - Virtual size: 256B

.t6ata
Size: 256B - Virtual size: 256B

.t5ata
Size: 256B - Virtual size: 256B

.t4ata
Size: 256B - Virtual size: 256B

.t3ata
Size: 256B - Virtual size: 256B

.t2ata
Size: 256B - Virtual size: 256B

.t1ata
Size: 512B - Virtual size: 512B

.rata
Size: 2KB - Virtual size: 2KB

INIT
Size: 960B - Virtual size: 940B

.reloc
Size: 640B - Virtual size: 628B