c8647f6ca0f80d88ef7bc4f17fbe278de88ea3eda12899b1237ce8467785eb5f

General

Target

c8647f6ca0f80d88ef7bc4f17fbe278de88ea3eda12899b1237ce8467785eb5f
Size

24KB
MD5

38c09d305d4f2ddf2cd91d3fd8797420
SHA1

0d52249d082856106f603c53784bd632207313af
SHA256

c8647f6ca0f80d88ef7bc4f17fbe278de88ea3eda12899b1237ce8467785eb5f
SHA512

78855f07ab3d0c1cfdd99e4bd1a758786b0e9a14b1fa004681758afdf0b1a83dd98de195c7252bb45d4083f11617e633f31acf97cf522126e3b8f2edf68c278d
SSDEEP

768:r+j7l7l7l7l7l7l7FEXPIFG72xPat2v1Y:rC5v1

Score

N/A

Malware Config

Signatures

Files

c8647f6ca0f80d88ef7bc4f17fbe278de88ea3eda12899b1237ce8467785eb5f
.exe windows x86

06134b71d8f165e4696bfd815bd70edb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
RtlInitUnicodeString
MmUserProbeAddress
ProbeForWrite
ProbeForRead
_except_handler3
_stricmp
IofCompleteRequest
ExFreePool
strrchr
ExAllocatePoolWithTag
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 864B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.v3ata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 846B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06134b71d8f165e4696bfd815bd70edb

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 864B - Virtual size: 852B

.data Size: 7KB - Virtual size: 7KB

.t1ata Size: 512B - Virtual size: 512B

.v3ata Size: 2KB - Virtual size: 2KB

INIT Size: 864B - Virtual size: 846B

.reloc Size: 928B - Virtual size: 924B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 864B - Virtual size: 852B

.data
Size: 7KB - Virtual size: 7KB

.t1ata
Size: 512B - Virtual size: 512B

.v3ata
Size: 2KB - Virtual size: 2KB

INIT
Size: 864B - Virtual size: 846B

.reloc
Size: 928B - Virtual size: 924B