2523aa20009ac0be71f73462e3103ffeccdd8a562798380113bcc42a1a822620

General

Target

2523aa20009ac0be71f73462e3103ffeccdd8a562798380113bcc42a1a822620
Size

17KB
MD5

0cdba5671633eff5d9b25f9475120f30
SHA1

b9e7b941dfa3bfab79dea8edf1965e18f3f650ff
SHA256

2523aa20009ac0be71f73462e3103ffeccdd8a562798380113bcc42a1a822620
SHA512

06a3454978792a394a63e00859cf0e359408d0aff53b29e5ff38cfe21bf309c82fe4c1e05a5e98237d7ead2af277216a9211960581ef25e2cae0005148d34d7a
SSDEEP

384:IxHH1COE3SCRUA0gk6Hb63iI8OZg3kfR2peymu8AXLJLAfldA9sl7fTzt+svcGSm:O8OE0+ndmb

Score

N/A

Malware Config

Signatures

Files

2523aa20009ac0be71f73462e3103ffeccdd8a562798380113bcc42a1a822620
.exe windows x86

0c86d2f8085802cf349ec80eaf5929a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExFreePool
PsTerminateSystemThread
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
ZwQueryInformationProcess
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
strncmp

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 912B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 370B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c86d2f8085802cf349ec80eaf5929a6

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 15KB - Virtual size: 15KB

zdata Size: 288B - Virtual size: 260B

vdata Size: 288B - Virtual size: 260B

INIT Size: 928B - Virtual size: 912B

.reloc Size: 384B - Virtual size: 370B

.text
Size: 15KB - Virtual size: 15KB

zdata
Size: 288B - Virtual size: 260B

vdata
Size: 288B - Virtual size: 260B

INIT
Size: 928B - Virtual size: 912B

.reloc
Size: 384B - Virtual size: 370B