d540806c071d9cf4ddc0f913969b53b2f5999b8f3e44fcec6fea1924fa7becf4

General

Target

d540806c071d9cf4ddc0f913969b53b2f5999b8f3e44fcec6fea1924fa7becf4
Size

81KB
MD5

1748b8cd4334827d6f7095aa6d8e9e00
SHA1

e04fa4ec91dc05001b1321e20ed593312b55f419
SHA256

d540806c071d9cf4ddc0f913969b53b2f5999b8f3e44fcec6fea1924fa7becf4
SHA512

167ceca01393a50398fce9d38e0b44acec59b62c38016ffcf28e3148283f6e55df394b626ff82e0aac0a6b7b0b5d71c7136660952fc2e53151009d8ea6ea1fb8
SSDEEP

1536:fqXjp+F8u6QlXJnYAM+RTYQv2tb/rTHZRiXiDisCqRA/X51:4p+m8XPRYq2xLZNDXCqRA/Xv

Score

N/A

Malware Config

Signatures

Files

d540806c071d9cf4ddc0f913969b53b2f5999b8f3e44fcec6fea1924fa7becf4
.exe windows x86

b3f700a764ba6b8598256d2514ac4811

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeServiceDescriptorTable
IoFreeMdl
MmUnmapLockedPages
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
ZwEnumerateValueKey
ZwEnumerateKey
ZwQueryDirectoryFile
ZwQuerySystemInformation
IofCompleteRequest
ExAllocatePoolWithTag
wcslen
ZwClose
ZwCreateFile
RtlInitUnicodeString
strncmp
IoGetCurrentProcess
ZwDeleteValueKey
ZwOpenKey
ZwSetValueKey
ZwReadFile
ZwOpenFile
ZwWriteFile
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
swprintf
MmCreateMdl
ExFreePoolWithTag
ZwQueryValueKey
ZwCreateKey
KeDelayExecutionThread
_stricmp
PsLookupProcessByProcessId
IoDeleteDevice
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
ZwQueryInformationFile
ZwAdjustPrivilegesToken
ZwOpenProcessToken
wcscmp
_alldiv
ObReferenceObjectByHandle
ZwOpenProcess
_strnicmp
MmIsAddressValid
KeDetachProcess
MmHighestUserAddress
ZwQueryInformationProcess
KeAttachProcess
MmBuildMdlForNonPagedPool
wcsrchr
MmMapLockedPages

hal

KfRaiseIrql
KeGetCurrentIrql

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 333B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3f700a764ba6b8598256d2514ac4811

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 384B - Virtual size: 333B

.data Size: 69KB - Virtual size: 69KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 384B - Virtual size: 333B

.data
Size: 69KB - Virtual size: 69KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB