7f64ddad9bb3f3fa0d99edd6cb5643dfbe74ca8504a8466a35ba3ea65b88e40c

Sharing

Copy URL Twitter E-mail

General

Target

7f64ddad9bb3f3fa0d99edd6cb5643dfbe74ca8504a8466a35ba3ea65b88e40c
Size

164KB
MD5

10660ca0d5c9f2ba371c73bb774f71a0
SHA1

76d4decea8cf5a7cc5bac7d0c6f1751f5059c54a
SHA256

7f64ddad9bb3f3fa0d99edd6cb5643dfbe74ca8504a8466a35ba3ea65b88e40c
SHA512

51f7efebdd86acc315f2578cbbfb2c3adb1ac81758c48a4402caa6e949e921a9486b2455b2c10829b89980ba7128836c23636098a81e7aa9499391d2d17b8f34
SSDEEP

3072:hDIacb1bigf8inWvmlBeewgiciVnPZK+sl6LA+HgQcW+s6RH:Kacb1rfdumlBej1VnP4ygTW+s6R

Score

N/A

Malware Config

Signatures

Files

7f64ddad9bb3f3fa0d99edd6cb5643dfbe74ca8504a8466a35ba3ea65b88e40c
.exe windows x86

ee18a8fec793a10d973e71412e7477b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
RtlFreeAnsiString
RtlFreeUnicodeString
IoDeleteDevice
sprintf
KeSetEvent
PsCreateSystemThread
RtlUnicodeStringToAnsiString
ZwClose
IoCreateDevice
KeQuerySystemTime
strncpy
strncmp
strstr
MmIsAddressValid
IoUnregisterFsRegistrationChange
IoRegisterFsRegistrationChange
IoAllocateMdl
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
wcsncpy
RtlInitAnsiString
wcsncat
IoFreeMdl
IoDriverObjectType
MmProbeAndLockPages
MmUnlockPages
ObReferenceObjectByName
KeDelayExecutionThread
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
tolower
ExAllocatePool
ExFreePool
isupper
ObReferenceObjectByHandle
RtlImageDirectoryEntryToData
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
isdigit
ZwQueryDirectoryObject
_wcsicmp
RtlCompareUnicodeString
MmMapLockedPages
ZwOpenDirectoryObject
ZwQueryValueKey
KeServiceDescriptorTable
ZwLoadDriver
ZwEnumerateKey
ZwOpenKey
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
ZwEnumerateValueKey
strchr
RtlInitUnicodeString
RtlTimeToTimeFields
KeInitializeEvent
PsTerminateSystemThread
KeTickCount
ZwFlushKey
ZwDeleteKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
toupper
isspace
RtlAnsiStringToUnicodeString
IofCompleteRequest
ZwQuerySystemInformation
memcpy
memset
_except_handler3
_allrem

hal

KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee18a8fec793a10d973e71412e7477b0

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 129KB - Virtual size: 128KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 5KB - Virtual size: 24KB

INIT Size: 3KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 129KB - Virtual size: 128KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 5KB - Virtual size: 24KB

INIT
Size: 3KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 8KB