c5c066c97e30475a6f875fff3011b455e5213999dfa3c2a891e3f42f8795f4dc

Sharing

Copy URL Twitter E-mail

General

Target

c5c066c97e30475a6f875fff3011b455e5213999dfa3c2a891e3f42f8795f4dc
Size

174KB
MD5

0dd270e792a58c59f5eb89081a2a3240
SHA1

956f88ab63d4e919c9d767b57ae1503a0ef22850
SHA256

c5c066c97e30475a6f875fff3011b455e5213999dfa3c2a891e3f42f8795f4dc
SHA512

3abd14287883771b8c4ae9067ea5ea507e949384379cc35b2cadab4b64ed2077bbf0fed0dcb4cb0a098a100c56503c673d705fb723c47b7ea7bf0f2230c89d2f
SSDEEP

3072:BUPf/8s4luquu4kdeolVzekCsiglI0MggznrljSxcja4plfH3N:WP3P8upkdeoOtsi+2FSxcja4XH3N

Score

N/A

Malware Config

Signatures

Files

c5c066c97e30475a6f875fff3011b455e5213999dfa3c2a891e3f42f8795f4dc
.exe windows x86

5977ed8602ebad4641562ad37202eca8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
RtlFreeAnsiString
RtlFreeUnicodeString
IoDeleteDevice
PsCreateSystemThread
sprintf
KeSetEvent
RtlUnicodeStringToAnsiString
ZwClose
IoCreateDevice
strncmp
strstr
KeQuerySystemTime
strncpy
MmIsAddressValid
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
wcsncpy
RtlInitAnsiString
wcsncat
IoFreeMdl
IoDriverObjectType
MmProbeAndLockPages
MmUnlockPages
ObReferenceObjectByName
IoRegisterFsRegistrationChange
IoAllocateMdl
KeDelayExecutionThread
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
tolower
ExAllocatePool
RtlAnsiStringToUnicodeString
isupper
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
ZwQueryValueKey
isdigit
_wcsicmp
RtlCompareUnicodeString
MmMapLockedPages
ZwEnumerateValueKey
KeServiceDescriptorTable
ZwLoadDriver
ZwEnumerateKey
ZwOpenKey
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
RtlInitUnicodeString
ZwOpenDirectoryObject
ZwQueryDirectoryObject
RtlTimeToTimeFields
strchr
KeInitializeEvent
PsTerminateSystemThread
KeTickCount
ZwDeleteKey
ZwFlushKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
isspace
toupper
ObReferenceObjectByHandle
IofCompleteRequest
ExFreePool
memcpy
memset
_except_handler3
_allrem

hal

KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5977ed8602ebad4641562ad37202eca8

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 24KB - Virtual size: 23KB

INIT Size: 2KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 24KB - Virtual size: 23KB

INIT
Size: 2KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB