b526f8339e49fb5a94178ca5dd0ceba91d14349558ea1908affb0f3afb00443e

General

Target

b526f8339e49fb5a94178ca5dd0ceba91d14349558ea1908affb0f3afb00443e
Size

61KB
MD5

05fda8df5edaaf0a26e132c69facedee
SHA1

5440d5a88d02fc07694da71ff2fbff305bda4549
SHA256

b526f8339e49fb5a94178ca5dd0ceba91d14349558ea1908affb0f3afb00443e
SHA512

6bf75ce0965fc27b2adebe566570cfd1acbf269dbfbe8eab474b40a9bac1e25de2969c5e2b6d39da195c82002930ac333e22ef7bb3079e150b2430f8f1f41291
SSDEEP

1536:w/kiCkEUsxYikMFt/B7BzOcKTZLe4wtkXDfx:1bUs6MFtHzOco5e4w2F

Score

N/A

Malware Config

Signatures

Files

b526f8339e49fb5a94178ca5dd0ceba91d14349558ea1908affb0f3afb00443e
.exe windows x86

5ea44720afe75318a46fa79a0e57d423

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeRestoreFloatingPointState
READ_REGISTER_USHORT
_alldiv
_allmul
_allshr
_allshl
KeInitializeMutex
KeWaitForSingleObject
KeReleaseMutex
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
KeQuerySystemTime
KeSaveFloatingPointState
KeInitializeSpinLock
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
KeTickCount
KeBugCheckEx
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
ExFreePool
InterlockedDecrement
InterlockedIncrement
RtlRaiseException

hal

KfAcquireSpinLock
KfReleaseSpinLock

portcls.sys

PcNewPort
PcRegisterSubdevice
PcInitializeAdapterDriver
PcAddAdapterDevice

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.PAGE
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5ea44720afe75318a46fa79a0e57d423

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

portcls.sys

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 17KB - Virtual size: 17KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 210B

.PAGE Size: 256B - Virtual size: 256B

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 17KB - Virtual size: 17KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 210B

.PAGE
Size: 256B - Virtual size: 256B