c6c56bfb6fc64e3103aa04ce4dc7ee4142e1d7b0b3df4e176d14a4ea16828763

General

Target

c6c56bfb6fc64e3103aa04ce4dc7ee4142e1d7b0b3df4e176d14a4ea16828763
Size

40KB
MD5

03145d21e704151894635ae70a4188b3
SHA1

050f8220af325560efc37a1c81a803c3c8d074fe
SHA256

c6c56bfb6fc64e3103aa04ce4dc7ee4142e1d7b0b3df4e176d14a4ea16828763
SHA512

152ad86794e179276de00786ffcda84dc745facbcb57bdde1e57f12ec4b37cbcecd4f5e9c3fa621cf30c7fa84bf9ee5e362859467147d5e42ed3891eae949666
SSDEEP

768:bYsL+oom51ASIy+Y2x/V3AVdzknFhYoeFZO4kmGPixgnE80FtCPnn/xlR9yr72wD:bOFKRDHWO/iIoe/OpmGZUQn/Xyr72+

Score

N/A

Malware Config

Signatures

Files

c6c56bfb6fc64e3103aa04ce4dc7ee4142e1d7b0b3df4e176d14a4ea16828763
.exe windows x86

056b9687412a81716fbf58766a83ec0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_stricmp
swprintf
wcsstr
_wcslwr
MmIsAddressValid
IoDeviceObjectType
wcslen
ZwCreateKey
RtlInitUnicodeString
wcsncpy
wcsrchr
RtlCompareUnicodeString
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwClose
ZwQueryValueKey
ZwOpenKey
wcscat
wcscpy
RtlCopyUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ObReferenceObjectByHandle
ExFreePool
_snprintf
ExAllocatePoolWithTag
_except_handler3
IofCompleteRequest
_snwprintf
IoRegisterDriverReinitialization
PsGetVersion
ObfDereferenceObject
strncpy
IoGetCurrentProcess
ZwCreateFile
PsCreateSystemThread
ZwDeleteKey
strncmp
KeDelayExecutionThread
KeQuerySystemTime
KeTickCount
KeQueryTimeIncrement
ZwSetInformationFile
_wcsicmp
wcschr
PsLookupProcessByProcessId

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 64B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

056b9687412a81716fbf58766a83ec0c

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 6KB

PAGE Size: 64B - Virtual size: 64B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 6KB

PAGE
Size: 64B - Virtual size: 64B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB