dd3eee84370ba3276162c3d2735acd4d84b3b5ff4bbd8c7b2388e55e3e919e7c

General

Target

dd3eee84370ba3276162c3d2735acd4d84b3b5ff4bbd8c7b2388e55e3e919e7c
Size

53KB
MD5

0f20f76268ee35e4adc1bd9c82b52d30
SHA1

f178cf3f1263b9649b52114d696bb638e6ca3999
SHA256

dd3eee84370ba3276162c3d2735acd4d84b3b5ff4bbd8c7b2388e55e3e919e7c
SHA512

721519bfb534ee29cae9d79ba86cf883bdf0beefee8413ed5fda6d0210221ce3c18df82e7724714db7945094dc17549badcf9783a159123054e12527b9bb4efd
SSDEEP

768:KF3eL7P5ODF3jvHRmmxwuFLEGjurB/SLIyKNoukC6fiDKYnIWmla:KF3eP5y3rx3FLEJtSE3gC6fHzdl

Score

N/A

Malware Config

Signatures

Files

dd3eee84370ba3276162c3d2735acd4d84b3b5ff4bbd8c7b2388e55e3e919e7c
.exe windows x86

282edf89fde9193cc476b0c83d9ce6f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KefReleaseSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlInitUnicodeString
DbgPrint
ZwOpenProcess
ObOpenObjectByPointer
PsProcessType
ZwClose
ZwWriteFile
ZwCreateFile
ZwDeleteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePool
ZwQueryInformationFile
RtlCompareString
RtlInitString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
KeServiceDescriptorTable
PsGetVersion
memset
KefAcquireSpinLockAtDpcLevel
RtlCopyUnicodeString
RtlCompareUnicodeString
PsLookupProcessByProcessId
ZwQuerySystemInformation
PsTerminateSystemThread
KeInsertQueueApc
KeInitializeApc
MmIsAddressValid
IoThreadToProcess
PsLookupThreadByThreadId
ZwSetValueKey
ZwCreateKey
ZwDeleteKey
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
IoFreeMdl
MmUnmapLockedPages
IoCheckShareAccess
RtlCompareMemory
IoDeleteDevice
PsCreateSystemThread
_allmul
RtlFreeUnicodeString
KeDelayExecutionThread

hal

KeRaiseIrqlToDpcLevel
KfLowerIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

282edf89fde9193cc476b0c83d9ce6f2

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 31KB - Virtual size: 31KB

PAGE Size: 8KB - Virtual size: 7KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 31KB - Virtual size: 31KB

PAGE
Size: 8KB - Virtual size: 7KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB