069052350e6d8729d203fbb21b4a5b60f8acd208c02d0160f88388ed2d9d2ea8

Sharing

Copy URL Twitter E-mail

General

Target

069052350e6d8729d203fbb21b4a5b60f8acd208c02d0160f88388ed2d9d2ea8
Size

41KB
MD5

0af07dff057951d2a06f755f3705e350
SHA1

40da096efcecfd4a23639292f792e7c50f6f0267
SHA256

069052350e6d8729d203fbb21b4a5b60f8acd208c02d0160f88388ed2d9d2ea8
SHA512

1d89a845fe2adb78a1924e97a0f33fbe17c731488a6be6a69cf84df6437da186c0af5e60e6f0a4b118727f2d596f897387000873f9ca52b0d65ed653b1dc3b8b
SSDEEP

768:iOoS0xZUctv16KXwyX5xdPPoPZvbUqwWaXh0Nu9vzFY+ViEmDsAUwbf2W0U:PL0jFww5LPPyZvbUvdh0Nu9LSOoYfc28

Score

N/A

Malware Config

Signatures

Files

069052350e6d8729d203fbb21b4a5b60f8acd208c02d0160f88388ed2d9d2ea8
.exe windows x86

13012670e6e387b3dcfce3c6e47e3f02

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_stricmp
swprintf
wcsstr
_wcslwr
ZwSetValueKey
wcslen
MmIsAddressValid
IoDeviceObjectType
ZwCreateKey
RtlInitUnicodeString
wcsncpy
wcsrchr
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
KeTickCount
KeQueryTimeIncrement
MmGetSystemRoutineAddress
IoGetCurrentProcess
PsGetVersion
_wcsicmp
wcscat
wcscpy
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeQuerySystemTime
_snwprintf
ExAllocatePoolWithTag
ExFreePool
_snprintf
ZwCreateFile
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
KeDelayExecutionThread
strncmp
_wcsnicmp
ObReferenceObjectByHandle
ObfDereferenceObject
IoRegisterDriverReinitialization
IofCompleteRequest
ZwSetInformationFile
wcschr
RtlCopyUnicodeString
ZwDeleteKey
PsSetCreateProcessNotifyRoutine

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 63B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEWMI
Size: 32B - Virtual size: 10B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDRV
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESYS
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEALL
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGECODE
Size: 32B - Virtual size: 3B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 736B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13012670e6e387b3dcfce3c6e47e3f02

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 6KB

PAGE Size: 64B - Virtual size: 63B

PAGEWMI Size: 32B - Virtual size: 10B

PAGEDRV Size: 32B - Virtual size: 8B

PAGESYS Size: 32B - Virtual size: 8B

PAGEALL Size: 32B - Virtual size: 8B

PAGEDATA Size: 32B - Virtual size: 8B

PAGECODE Size: 32B - Virtual size: 3B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 736B - Virtual size: 712B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 6KB

PAGE
Size: 64B - Virtual size: 63B

PAGEWMI
Size: 32B - Virtual size: 10B

PAGEDRV
Size: 32B - Virtual size: 8B

PAGESYS
Size: 32B - Virtual size: 8B

PAGEALL
Size: 32B - Virtual size: 8B

PAGEDATA
Size: 32B - Virtual size: 8B

PAGECODE
Size: 32B - Virtual size: 3B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 736B - Virtual size: 712B

.reloc
Size: 1KB - Virtual size: 1KB