7fa9fe3894c3ae1611e891b70bdce85b2dd91652b73513dc68ad79319dc16cbf

General

Target

7fa9fe3894c3ae1611e891b70bdce85b2dd91652b73513dc68ad79319dc16cbf
Size

191KB
MD5

f1d723d5a81093ecf036cb9d3f74e01f
SHA1

25fa8cdc4570e316b2c86b3aa042501838f3c338
SHA256

7fa9fe3894c3ae1611e891b70bdce85b2dd91652b73513dc68ad79319dc16cbf
SHA512

e085002b9b01d64e068b2ae353919d9f373b39aafe5b00f2ae160917f74a28df87f8936636dddd78e2a261d3beeb24158f085ce3fb58c82f2c90703837c6b6db
SSDEEP

3072:9gQG2d8Hv6DLbvDGWSsQ4c3lL9UvS+Aml4TlRXS+hE2PZnzZWnWDM2xednV4ij:9g9nw7h/0h9UqRXS+hE2PZMWDM2xed

Score

N/A

Malware Config

Signatures

Files

7fa9fe3894c3ae1611e891b70bdce85b2dd91652b73513dc68ad79319dc16cbf
.exe windows x86

7083b7f53358c431a9238cf234409f78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwEnumerateValueKey
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwClose
RtlInitUnicodeString
ObReferenceObjectByHandle
ZwOpenProcess
ZwQuerySystemInformation
_strnicmp
MmIsAddressValid
KeDetachProcess
MmHighestUserAddress
ZwQueryInformationProcess
DbgPrint
swprintf
strncmp
IoGetCurrentProcess
KeDelayExecutionThread
ZwDeleteValueKey
ZwOpenKey
ZwSetValueKey
MmGetSystemRoutineAddress
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoFreeMdl
MmUnmapLockedPages
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
ZwQueryDirectoryFile
_stricmp
IoRegisterDriverReinitialization
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoCreateSymbolicLink
ZwEnumerateKey
KeAttachProcess
wcslen

hal

KfRaiseIrql
KeGetCurrentIrql

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 267B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7083b7f53358c431a9238cf234409f78

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 384B - Virtual size: 267B

.data Size: 180KB - Virtual size: 180KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 384B - Virtual size: 267B

.data
Size: 180KB - Virtual size: 180KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB