f7999a943f386dbb4f7cb97d97628683e9bd55852e9fecd7264b05866f16a497

General

Target

f7999a943f386dbb4f7cb97d97628683e9bd55852e9fecd7264b05866f16a497
Size

445KB
MD5

01ed03a74df2ecd191a2f446e5f593b0
SHA1

80a6bda55a8896fc8ddbbcda7680988624e4d2fa
SHA256

f7999a943f386dbb4f7cb97d97628683e9bd55852e9fecd7264b05866f16a497
SHA512

1a21a97c51c5e0e3c35470042b8c1304948b6bece24655492b951fce108f91c57824cad6c10539efa686923ec572495d67a1b525082a373e07d1fc89cfd3a73e
SSDEEP

12288:8v8Y2+/BtKy4LE4wxubJ2Li73ZpjgRdKWQ:8v8OiW/MbJ2LO3ZpkRIx

Score

N/A

Malware Config

Signatures

Files

f7999a943f386dbb4f7cb97d97628683e9bd55852e9fecd7264b05866f16a497
.dll windows x86

e681e73eff16f4ff99d4a7cc8598ac58

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeReadStateTimer
RtlDeleteNoSplay
IoGetCurrentProcess
KeReadStateMutex
ExInitializeResourceLite
SeTokenIsRestricted
SeDeassignSecurity
ZwMapViewOfSection
IoAttachDeviceToDeviceStack
KeCancelTimer
ZwFlushKey
IoDeleteDevice
strcpy
KdEnableDebugger
FsRtlIsDbcsInExpression
RtlInitUnicodeString
RtlxUnicodeStringToAnsiSize
RtlCompareString
KeInitializeTimerEx
RtlInitString
ZwQuerySymbolicLinkObject
RtlIntegerToUnicodeString
RtlEqualUnicodeString
IoCheckShareAccess
KeInitializeQueue
RtlFindLastBackwardRunClear
RtlEqualString
KeRundownQueue

Exports

Exports

KDZ__BZUuilINR__Q
BHr_luHdc__QNIw_ttslld_aLSHGPFYr
FGN_Q_mptjb_i__xuhd_wdeswb___dQAQ_
xciYMxiEFC_wiTCAgbdxYEYJU_FYXBDX_OZfj_uufcxfj
vmu_UDDedvWcDJPtejidnmqnvjh_iGAOV_rdxqW_
gaqadUYKPXFUOACosBTNAUFIxkUOb_H_HSZEGQ_VGjb__bOISOD
edmftnfe___m__qtO
iKRNWZW_N_YnISYmz_dwb_i
iyw_vt_DYXIEeoadVPHQ_YFydq_caS_DkfzmB__GO_R
EBNGPX_YTNDe_kbah_cLdzRD_Phscnf_qtaB
DJTC_RXBdcgZW_GYRBHSajn_yry_
O__MWN_ev
R__XPE_No_AHFX_WXFSALC
XeyHM_LOSZO___FRDY__Z_A_URR
gvjkTC_D_o
wdfvvh_v_z_tn_HZL
FYGPZ____QA_NLVsfa_kvTDE_YNhDUJ_OH_j__tbk
G_RIDNzcw_gPVCQOVFK

Sections

.text
Size: 24KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e681e73eff16f4ff99d4a7cc8598ac58

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 88KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 10KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 88KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1KB - Virtual size: 1KB