91c4c6c59b1004a5c58e04807fbfe890fca4bb641901c29fd665a7499a42c170

General

Target

91c4c6c59b1004a5c58e04807fbfe890fca4bb641901c29fd665a7499a42c170
Size

11KB
MD5

1e93695b132e96b67fedb6e0a48e76f0
SHA1

9a74c43612f91a477c677d2e8d78c0c83b27c094
SHA256

91c4c6c59b1004a5c58e04807fbfe890fca4bb641901c29fd665a7499a42c170
SHA512

f44b89cbaebb4ff29a9b0e9a630b077511c38c4946c60b6ad80e45af58ed8a85bf8dda9ce0e67f60c1e12207a4e29aaebf346c4c3f6570c14a18d6ff686c09da
SSDEEP

192:NfDwH6VPWbQ0oPKgnKFIG2EWUovCk5/ZDmss4/:xDwaVPOeKryCkbDmsv

Score

N/A

Malware Config

Signatures

Files

91c4c6c59b1004a5c58e04807fbfe890fca4bb641901c29fd665a7499a42c170
.exe windows x86

18e74cd9b722c97e921d5a9c36578080

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwCreateFile
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwCreateKey
KeServiceDescriptorTable
RtlInitUnicodeString
RtlCompareMemory
IofCompleteRequest
IoRegisterDriverReinitialization
RtlFreeAnsiString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
swprintf
mbstowcs
IoCreateSymbolicLink
IoCreateDevice
wcscat
_strlwr
RtlUnicodeStringToAnsiString
wcsrchr
_wcslwr
ZwEnumerateKey
ZwOpenKey
ExFreePool
ExAllocatePoolWithTag
ZwOpenFile
strncmp
IoGetCurrentProcess
PsTerminateSystemThread
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
sprintf
_stricmp
strncpy
PsLookupProcessByProcessId
KeDelayExecutionThread
wcslen
_snprintf
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
MmIsAddressValid
ZwUnmapViewOfSection
_except_handler3

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 319B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 768B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18e74cd9b722c97e921d5a9c36578080

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 384B - Virtual size: 319B

.data Size: 2KB - Virtual size: 2KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 768B - Virtual size: 760B

.reloc Size: 640B - Virtual size: 612B

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 384B - Virtual size: 319B

.data
Size: 2KB - Virtual size: 2KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 768B - Virtual size: 760B

.reloc
Size: 640B - Virtual size: 612B