General

Malware Config

Signatures

Files

• c372a44253acb6e97da1defe1dad8d9de93a15c5fe77ce8e59f66305adc7ada6

  .exe windows x86

  66e26ce4c87fcc25711b6ae38b998928

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ntoskrnl.exe

  IoStartNextPacket

  IoReleaseCancelSpinLock

  KeRemoveDeviceQueue

  InterlockedExchange

  IoAcquireCancelSpinLock

  IoStartPacket

  IoDeleteDevice

  KeSetTimer

  InterlockedIncrement

  MmMapLockedPages

  MmBuildMdlForNonPagedPool

  MmCreateMdl

  KeServiceDescriptorTable

  MmPageEntireDriver

  KeInitializeEvent

  KeInitializeTimer

  KeInitializeDpc

  PsSetLoadImageNotifyRoutine

  KeRemoveEntryDeviceQueue

  IoCreateDevice

  ExReleaseResourceLite

  ExFreePool

  ZwClose

  ZwWriteFile

  ExAllocatePoolWithTag

  ZwCreateFile

  ExAcquireResourceExclusiveLite

  RtlInitUnicodeString

  ZwSetValueKey

  ZwCreateKey

  ZwDeleteValueKey

  tolower

  RtlFreeAnsiString

  ZwTerminateProcess

  ZwOpenProcess

  RtlInitAnsiString

  RtlUnicodeStringToAnsiString

  KeCancelTimer

  MmUnlockPagableImageSection

  MmLockPagableDataSection

  IofCompleteRequest

  ZwQuerySystemInformation

  InterlockedDecrement

  hal

  KfLowerIrql

  ExAcquireFastMutex

  ExReleaseFastMutex

  HalMakeBeep

  KfRaiseIrql

  Sections

  .text

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  INIT

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 176B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 806B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ