3e79331b8db0c6c5c216ee19b5ebdd4ccf4240fdd5251a982906d5834c51e201

Sharing

Copy URL Twitter E-mail

General

Target

3e79331b8db0c6c5c216ee19b5ebdd4ccf4240fdd5251a982906d5834c51e201
Size

102KB
MD5

0d6889b20bf7a0f94c67863e9552bc70
SHA1

41f3d196bcceed038289ce23483cb909b141ad69
SHA256

3e79331b8db0c6c5c216ee19b5ebdd4ccf4240fdd5251a982906d5834c51e201
SHA512

09d9ef83b69571be0bfb78e133a3fd33f041116eb7a855d1d8f5fa9b87ea17f6133ad4c5954e79e718fdc286f4e162bd9a0d3626308adeeedd73d3f365bfeb39
SSDEEP

1536:HHZEGCtVNJMCtaxUshl4wKPTtgzLuD3UBhMP625vG:ZMhMdwPTtgryT5O

Score

N/A

Malware Config

Signatures

Files

3e79331b8db0c6c5c216ee19b5ebdd4ccf4240fdd5251a982906d5834c51e201
.exe windows x86

93365491074b38925ddd1482d990b3ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_strnset
memcpy
ExAllocatePool
strstr
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
wcsstr
_wcsnset
ZwReadFile
ExFreePoolWithTag
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
RtlCompareString
RtlInitString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
KeServiceDescriptorTable
ZwSetValueKey
ZwCreateKey
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
ObReferenceObjectByName
atoi
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
IoBuildAsynchronousFsdRequest
memset
MmIsAddressValid
ZwPulseEvent
ZwAllocateVirtualMemory
ObOpenObjectByPointer
ProbeForRead
IoGetCurrentProcess
_strupr
PsGetProcessImageFileName
PsLookupProcessByProcessId
_wcsupr
PsRemoveLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutine
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
PsGetVersion
DbgPrint
IoRegisterShutdownNotification
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
RtlUnwind
IoDriverObjectType
strchr

hal

KeGetCurrentIrql

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 81KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93365491074b38925ddd1482d990b3ff

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 81KB - Virtual size: 86KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 744B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 81KB - Virtual size: 86KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 744B

.reloc
Size: 2KB - Virtual size: 1KB