General

Malware Config

Signatures

Files

• 4552487b4956f242264222815dedc0863c942ecc62f91c1bb02658cf76cc65af

  .exe windows x86

  ab33e00a60d7a135dadebff5a107e6b5

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ntoskrnl.exe

  strncpy

  RtlAppendUnicodeToString

  KeGetCurrentThread

  _except_handler3

  RtlInitUnicodeString

  IoFreeMdl

  MmUnmapLockedPages

  MmMapLockedPages

  MmBuildMdlForNonPagedPool

  IoAllocateMdl

  KeInitializeSpinLock

  wcsstr

  ExFreePoolWithTag

  _strlwr

  _wcslwr

  wcsncat

  wcscat

  ObfDereferenceObject

  ObQueryNameString

  ObReferenceObjectByHandle

  ExAllocatePoolWithTag

  IoGetCurrentProcess

  wcslen

  MmGetSystemRoutineAddress

  _stricmp

  ZwQuerySystemInformation

  RtlQueryRegistryValues

  PsGetCurrentProcessId

  IofCompleteRequest

  IoDeleteDevice

  KeServiceDescriptorTable

  wcscpy

  ObOpenObjectByName

  IoCreateSymbolicLink

  IoCreateDevice

  wcsncpy

  ZwCreateKey

  KeTickCount

  KeBugCheckEx

  _local_unwind2

  strncmp

  hal

  KeGetCurrentIrql

  Sections

  .text

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  INIT

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 928B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ