d868cf047e2ed9db6792d9b4a6e842f561774b71557e7801d936c6f19bf97657

Sharing

Copy URL Twitter E-mail

General

Target

d868cf047e2ed9db6792d9b4a6e842f561774b71557e7801d936c6f19bf97657
Size

63KB
MD5

0b6a5cf7c7089a63052c083ec0d98853
SHA1

3defc0a11550c04affb35ccfa6876b235914c4fe
SHA256

d868cf047e2ed9db6792d9b4a6e842f561774b71557e7801d936c6f19bf97657
SHA512

8f84ba02c21c28fa74f00cbc58cb9045213dc58cf294f834fc43c9c95a8a84128708f0055cb3408c4fbfd9bd4bc9a966dd615ae99c2d221b00815aaf376dfa8f
SSDEEP

768:U/NA29vprT5RIvVHBcq1F0hhovzSEAAzMQTBHaje10JyBaUfPOSpgn4na0ppT:4NA29vZyhcMjb/QCtNfk4N/

Score

N/A

Malware Config

Signatures

Files

d868cf047e2ed9db6792d9b4a6e842f561774b71557e7801d936c6f19bf97657
.exe windows x86

2da71861ca7a4f2be76f7e4a7ea53551

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

WRITE_PORT_BUFFER_UCHAR
KfReleaseSpinLock
HalTranslateBusAddress
HalGetInterruptVector
ExAcquireFastMutex
ExReleaseFastMutex
WRITE_PORT_UCHAR
KdComPortInUse
READ_PORT_UCHAR
KfRaiseIrql
KfLowerIrql
KfAcquireSpinLock

ntoskrnl.exe

IoCancelIrp
KeInitializeDpc
KeInitializeTimer
ExAllocatePoolWithTag
DbgBreakPoint
KeInitializeSpinLock
memmove
PoSetPowerState
KeWaitForSingleObject
ExAllocatePoolWithQuotaTag
_except_handler3
KeInsertQueueDpc
KeDelayExecutionThread
MmLockPagableSectionByHandle
MmQuerySystemSize
KeQuerySystemTime
KeSetEvent
KeSetTimer
IofCallDriver
PoCallDriver
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeCancelTimer
IoInvalidateDeviceState
IoQueryDeviceDescription
ZwClose
IoDetachDevice
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlDeleteRegistryValue
IoDeleteSymbolicLink
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
RtlWriteRegistryValue
IoCreateSymbolicLink
wcslen
RtlInitUnicodeString
KeInitializeEvent
IoCreateDevice
RtlIntegerToUnicodeString
IoAttachDeviceToDeviceStack
IoConnectInterrupt
RtlQueryRegistryValues
ZwQueryValueKey
ZwSetValueKey
ZwEnumerateKey
IoReportDetectedDevice
ZwOpenKey
PoRequestPowerIrp
PoStartNextPowerIrp
KeClearEvent
KeTickCount
KeBugCheckEx
IoDeleteDevice
IoGetConfigurationInformation
IoWMIRegistrationControl
IoDisconnectInterrupt
KeRemoveQueueDpc
MmUnmapIoSpace
MmMapIoSpace
MmLockPagableDataSection
ExFreePoolWithTag
MmUnlockPagableImageSection
_allmul
IoAcquireCancelSpinLock
KeSynchronizeExecution
IoReleaseCancelSpinLock
IoOpenDeviceRegistryKey
IofCompleteRequest

wmilib.sys

WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 384B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGESRP0
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESER
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2da71861ca7a4f2be76f7e4a7ea53551

Headers

File Characteristics

Imports

hal

ntoskrnl.exe

wmilib.sys

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 512B - Virtual size: 484B

.data Size: 384B - Virtual size: 280B

PAGESRP0 Size: 15KB - Virtual size: 15KB

PAGESER Size: 14KB - Virtual size: 14KB

INIT Size: 9KB - Virtual size: 9KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 512B - Virtual size: 484B

.data
Size: 384B - Virtual size: 280B

PAGESRP0
Size: 15KB - Virtual size: 15KB

PAGESER
Size: 14KB - Virtual size: 14KB

INIT
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 2KB - Virtual size: 1KB