fa153a742acc6b025e6668f1b7a7bddd7ecdc2787b58e9246ab6f305584c075c

General

Target

fa153a742acc6b025e6668f1b7a7bddd7ecdc2787b58e9246ab6f305584c075c
Size

24KB
MD5

3b9455d4644f97ce50c517818095c85a
SHA1

dbeb7514cb6225c7f62940c779cc887bf345308d
SHA256

fa153a742acc6b025e6668f1b7a7bddd7ecdc2787b58e9246ab6f305584c075c
SHA512

64c6812d65c4228c043602c982c7932261a4328692fb87457b8bbc7cd623c683141d31f0d314dd5d3b823301127df8127e351c0969b602bf1bd952859bbf8c86
SSDEEP

384:Rt06MzKfqP4VzZxPXjURL4JmN/68qnfNuaFyu3GTK7Or1SF+M0:Rt5MGSP4VLQJHNCJfNbFydTzSF+M0

Score

N/A

Malware Config

Signatures

Files

fa153a742acc6b025e6668f1b7a7bddd7ecdc2787b58e9246ab6f305584c075c
.exe windows x86

648196aa1d168be42ba363fcc6929575

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAcquireFastMutexUnsafe
KeQuerySystemTime
IoUnregisterShutdownNotification
NlsLeadByteInfo
PsSetLoadImageNotifyRoutine
ZwLoadKey
ObfReferenceObject
ZwQueryDirectoryObject
RtlRealPredecessor
RtlUpperChar
KeSetKernelStackSwapEnable
KeInsertQueueDpc
MmFreeNonCachedMemory
RtlCompareUnicodeString
RtlGetFirstRange
ZwCreateSymbolicLinkObject
wcslen
MmUnmapVideoDisplay
RtlInitString
CcFastMdlReadWait
RtlAnsiStringToUnicodeString
strcmp
memset
RtlImageNtHeader
ExAllocatePool
ZwQueryInformationProcess
ExFreePool
RtlUnicodeStringToAnsiString
FsRtlUninitializeFileLock
RtlFreeUnicodeString
NtCreateSection
_except_handler2
IoSetDeviceToVerify
FsRtlGetNextFileLock
KdDebuggerEnabled
ZwDisplayString

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MMM
Size: 512B - Virtual size: 262B

IMAGE_SCN_MEM_READ

.GGG
Size: 512B - Virtual size: 260B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LLL
Size: 512B - Virtual size: 52B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 38B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

648196aa1d168be42ba363fcc6929575

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 490B

.MMM Size: 512B - Virtual size: 262B

.GGG Size: 512B - Virtual size: 260B

.LLL Size: 512B - Virtual size: 52B

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 512B - Virtual size: 38B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 490B

.MMM
Size: 512B - Virtual size: 262B

.GGG
Size: 512B - Virtual size: 260B

.LLL
Size: 512B - Virtual size: 52B

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 512B - Virtual size: 38B