c3889ea26273b79a79e397bb4f0f5ad672b8fa6899c69807ba6b15f750612136

Sharing

Copy URL Twitter E-mail

General

Target

c3889ea26273b79a79e397bb4f0f5ad672b8fa6899c69807ba6b15f750612136
Size

39KB
MD5

09ccd7502ce171e15914a17104bb8700
SHA1

38337149e8c0305227d95c5c2792a6be49cfe316
SHA256

c3889ea26273b79a79e397bb4f0f5ad672b8fa6899c69807ba6b15f750612136
SHA512

ec2d31e43072fffd9369f2caa915f9f21a067153fcd41ed0eda390ad773cf172e8b2154984f0cc2e6a680601993d289bbe37fa50e768c65b57fc012ac1c9881b
SSDEEP

768:qT3vR+DVKB5ghwzjr/7fwch/GI/Q71Nuti2HZOZGOe1hLjgmZT662TWyRHtP:qTbDKOWWieOXMJEmJyB

Score

N/A

Malware Config

Signatures

Files

c3889ea26273b79a79e397bb4f0f5ad672b8fa6899c69807ba6b15f750612136
.exe windows x86

fea010d9f1cc35df62e6a9297f673c08

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memcpy
InterlockedExchange
IoRegisterShutdownNotification
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ObfReferenceObject
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoCreateFile
RtlInitUnicodeString
IoAttachDevice
ExAllocatePoolWithTag
ExFreePool
ZwEnumerateKey
_except_handler3
KeServiceDescriptorTable
isspace
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
_purecall
KeSetEvent
ZwClose
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlQueryRegistryValues
PsGetVersion
RtlCopyUnicodeString
ZwCreateKey
ZwQueryValueKey
wcscmp
wcscpy
wcslen
ZwDeleteKey
ZwEnumerateValueKey
ZwDeleteValueKey
ZwOpenKey
IofCallDriver
ZwFlushKey
ZwSetValueKey
_stricmp
ZwReadFile
PsTerminateSystemThread
PsCreateSystemThread
ObfDereferenceObject
RtlWriteRegistryValue
RtlCreateRegistryKey
swprintf
RtlDeleteRegistryValue
strcmp
ObQueryNameString
ObReferenceObjectByName
IoDriverObjectType
IoFreeIrp
ObInsertObject
KeGetCurrentThread
IoAllocateIrp
SeSetAccessStateGenericMapping
RtlMapGenericMask
SeCreateAccessState
ObCreateObject
IoFileObjectType
KeResetEvent
IoFreeMdl
MmUnlockPages
IoCancelIrp
MmProbeAndLockPages
IoAllocateMdl
KeWaitForMultipleObjects
strlen
_vsnprintf
_aulldiv
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeTickCount
KeBugCheckEx
IofCompleteRequest
memmove
wcscat
memset
strncpy
RtlCompareMemory
KeInitializeMutex
KeReleaseMutex
ZwWriteFile
KeQuerySystemTime
_allmul
strchr

hal

KfRaiseIrql
KeGetCurrentIrql
KfLowerIrql

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 896B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 128B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fea010d9f1cc35df62e6a9297f673c08

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 896B - Virtual size: 772B

PAGE Size: 13KB - Virtual size: 13KB

PAGEDATA Size: 128B - Virtual size: 13B

INIT Size: 2KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 896B - Virtual size: 772B

PAGE
Size: 13KB - Virtual size: 13KB

PAGEDATA
Size: 128B - Virtual size: 13B

INIT
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB