69d5f52e1f60ee6654fd72e8766fcd5556a912decee237f9c5a9eda229f49fb0

General

Target

69d5f52e1f60ee6654fd72e8766fcd5556a912decee237f9c5a9eda229f49fb0
Size

445KB
MD5

0cc17f496126cff6e1c69b99c0d98739
SHA1

27a2b115b0b935a95f61a016b4d77832939e480a
SHA256

69d5f52e1f60ee6654fd72e8766fcd5556a912decee237f9c5a9eda229f49fb0
SHA512

57cdd0de32cdc4e7841f96345e9e267cb7085be09e10d027a2665006c55081da3cc790e4905c41c0f6330873f3a82d3c2212d1600cb0b621b7502976d9e9351d
SSDEEP

12288:Tle4c6YOPuKt1eUApSRYdFWGxt+vFX3k:U1dOMpSRYdFWGxkvFH

Score

N/A

Malware Config

Signatures

Files

69d5f52e1f60ee6654fd72e8766fcd5556a912decee237f9c5a9eda229f49fb0
.exe windows x86

3f6a56b74234a4fabf92d8efc525d103

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTagPriority
IoReleaseCancelSpinLock
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
WmiTraceMessage
RtlLargeIntegerNegate
IofCompleteRequest
ProbeForRead
IoCheckShareAccess
wcslen
ObfDereferenceObject
_except_handler3
ObReferenceObjectByHandle
IoAcquireCancelSpinLock
RtlCompareMemory
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
ExRaiseStatus
ExRaiseAccessViolation
MmUserProbeAddress
_purecall
IoSetShareAccess
IoGetRequestorProcess
IoFreeWorkItem
IoAllocateWorkItem
KeAttachProcess
KeDetachProcess
IoGetCurrentProcess
ZwDeleteFile
RtlInitUnicodeString
swprintf
ZwCreateFile
ZwClose
ZwReadFile
ZwWriteFile
MmMapViewOfSection
MmUnmapViewOfSection
MmCreateSection
ObCloseHandle
KeInitializeEvent
WmiQueryTraceInformation
IoWMIRegistrationControl
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoQueueWorkItem
_allmul
_alldiv
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
IoRemoveShareAccess
KeSetTimer
KeCancelTimer
KeInitializeDpc
KeInitializeTimer
KeTickCount
KeBugCheckEx

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f6a56b74234a4fabf92d8efc525d103

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 35KB - Virtual size: 35KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 16KB

INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 214B

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 16KB

INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 214B