General

Malware Config

Signatures

Files

• b8a4043dbd9dc1592b4f715bbd27a2dfd63a59220d5598b40c6db81503350f71

  .exe windows x86

  ab5579bc562ad132dcf92fc29ee0abf7

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ntoskrnl.exe

  RtlGetNextRange

  RtlGetFirstRange

  RtlFindRange

  ExAllocatePoolWithTag

  swprintf

  IoGetDmaAdapter

  ExFreePoolWithTag

  KeBugCheckEx

  IofCallDriver

  IoBuildSynchronousFsdRequest

  KeInitializeEvent

  IoGetAttachedDeviceReference

  HalDispatchTable

  VfFailDeviceNode

  PoCallDriver

  PoStartNextPowerIrp

  IofCompleteRequest

  KdEnableDebugger

  KdDisableDebugger

  ExIsProcessorFeaturePresent

  DbgPrint

  InitSafeBootMode

  IoInvalidateDeviceRelations

  IoDeleteDevice

  IoDetachDevice

  ZwClose

  ZwQueryValueKey

  IoOpenDeviceRegistryKey

  IoAttachDeviceToDeviceStack

  IoCreateDevice

  HalPrivateDispatchTable

  IoAssignResources

  RtlxAnsiStringToUnicodeSize

  NlsMbCodePageTag

  _vsnprintf

  RtlAnsiStringToUnicodeString

  sprintf

  RtlIsRangeAvailable

  RtlFindMessage

  wcslen

  RtlFreeRangeList

  ZwEnumerateValueKey

  ZwQueryKey

  memmove

  RtlInitUnicodeString

  ZwEnumerateKey

  _snwprintf

  ZwOpenKey

  IoUnregisterPlugPlayNotification

  VfFailSystemBIOS

  IoRegisterPlugPlayNotification

  VfIsVerificationEnabled

  PoSetPowerState

  PoRequestPowerIrp

  IoCancelIrp

  IoReleaseCancelSpinLock

  KeDelayExecutionThread

  KeQueryTimeIncrement

  KdPowerTransition

  READ_REGISTER_BUFFER_ULONG

  READ_REGISTER_BUFFER_UCHAR

  _except_handler3

  MmUnmapIoSpace

  MmMapIoSpace

  IoGetDeviceProperty

  RtlAddRange

  RtlInitializeRangeList

  ZwSetValueKey

  ZwCreateKey

  IoBuildDeviceIoControlRequest

  KeTickCount

  _aulldiv

  KeEnterCriticalRegion

  KeWaitForSingleObject

  KeSetEvent

  KeLeaveCriticalRegion

  ObfDereferenceObject

  RtlInitAnsiString

  ObfReferenceObject

  RtlDeleteOwnersRanges

  RtlCopyRangeList

  _aullrem

  RtlDeleteRange

  _wcsicmp

  hal

  KeStallExecutionProcessor

  KfAcquireSpinLock

  KfReleaseSpinLock

  KeGetCurrentIrql

  HalGetBusDataByOffset

  HalTranslateBusAddress

  HalAdjustResourceList

  Sections

  .text

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  PAGE

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  INIT

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ