54c000bb25d2c27279bf594ae73c34bf302e951ca92c15f1e599c1245dc6a70a

General

Target

54c000bb25d2c27279bf594ae73c34bf302e951ca92c15f1e599c1245dc6a70a
Size

18KB
MD5

1110a307369af9fe484ba8a4fa5887f0
SHA1

d44024798bd883deac5efad7582a410a729363b8
SHA256

54c000bb25d2c27279bf594ae73c34bf302e951ca92c15f1e599c1245dc6a70a
SHA512

ad3739dba4e09a726bb0789f555c6a218c34d2389fde0d804193a5dbb250da77694e5ccb563cbff4d50131f21e32273625927deb2032eb4c57d43043335b431d
SSDEEP

384:n8Ck4fDO29vUfCVEcnd/ldm3u2TwkEi7Uhl:nxk4fDOoUKucdlQ+ewkXUD

Score

N/A

Malware Config

Signatures

Files

54c000bb25d2c27279bf594ae73c34bf302e951ca92c15f1e599c1245dc6a70a
.exe windows x86

d9bb040b3c1cfbb3023653647222e51b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
wcscpy
wcsstr
_wcsupr
ObQueryNameString
ExAllocatePoolWithTag
KeServiceDescriptorTable
IofCompleteRequest
DbgPrint
ZwClose
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQueryValueKey
ZwOpenKey
RtlFreeUnicodeString
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strstr
_strlwr
ZwQuerySystemInformation
_except_handler3
wcscat
RtlStringFromGUID
ExUuidCreate
ObfDereferenceObject
KeWaitForSingleObject
KeSetEvent
PsTerminateSystemThread
_strnicmp
IoGetCurrentProcess
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeEvent
IoFreeMdl
MmUnlockPages
PsLookupProcessByProcessId
MmProbeAndLockPages
IoAllocateMdl

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 768B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9bb040b3c1cfbb3023653647222e51b

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 512B - Virtual size: 436B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 768B - Virtual size: 662B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 512B - Virtual size: 436B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 768B - Virtual size: 662B