1bd9e47392f3388f1ac916d1ab8e1762e7f482ca422ca2431dfa47fb1463ebcf

Sharing

Copy URL Twitter E-mail

General

Target

1bd9e47392f3388f1ac916d1ab8e1762e7f482ca422ca2431dfa47fb1463ebcf
Size

37KB
MD5

701cc8ba6e86b22ccfa80dfba2fa6f47
SHA1

0e67827e591c77da08b6207f550e476c8c166c98
SHA256

1bd9e47392f3388f1ac916d1ab8e1762e7f482ca422ca2431dfa47fb1463ebcf
SHA512

8a7cfe43569d9c251070df241689d6418042e4fdb8c4dc5f9757911950d99d0b3b3df1bd1858fcbc5542605a818e5b39a051e61c6743dd9bf0f57bcaae98f080
SSDEEP

768:6IxD4SjmuJw/fJTbXcONS/vHwM6Vyg7L0giKhjRZJsIRKhANenxf+:jP++OMX7A7LYKhTJNRKhfx

Score

N/A

Malware Config

Signatures

Files

1bd9e47392f3388f1ac916d1ab8e1762e7f482ca422ca2431dfa47fb1463ebcf
.exe windows x86

b7867781a49e7bf65cbeebb78877da1a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeEvent
memset
ExFreePoolWithTag
ExAllocatePoolWithTag
memcpy
strncmp
strlen
MmMapLockedPagesSpecifyCache
IofCompleteRequest
PsGetCurrentProcessId
KeSetEvent
KeDelayExecutionThread
PsCreateSystemThread
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
ExAllocatePool
atoi
ZwClose
ObfDereferenceObject
wcscmp
IoGetLowerDeviceObject
ObReferenceObjectByHandle
IoCreateFile
RtlInitUnicodeString
ExInitializeResourceLite
PsGetVersion
_stricmp
RtlCompareMemory
RtlImageNtHeader
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
wcslen
RtlImageDirectoryEntryToData
KeGetCurrentThread
IoGetCurrentProcess
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
MmHighestUserAddress
strcpy
IoBuildDeviceIoControlRequest
ZwQueryInformationProcess
RtlEqualUnicodeString
strcmp
KeUnstackDetachProcess
KeStackAttachProcess
PsLookupProcessByProcessId
wcscat
_except_handler3
_alloca_probe
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeQueryActiveProcessors
IoFreeIrp
IoAllocateIrp
IoGetRelatedDeviceObject
KeInsertQueueApc
KeInitializeApc
ZwAllocateVirtualMemory
PsGetProcessImageFileName
_wcsupr
strcat
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
strncpy
strstr
IoFileObjectType
strchr
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
PsLookupThreadByThreadId
ExAcquireResourceSharedLite
MmIsAddressValid
FsRtlIsNameInExpression
IofCallDriver
ZwQuerySystemInformation
KeWaitForSingleObject

hal

KfReleaseSpinLock
KfAcquireSpinLock

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7867781a49e7bf65cbeebb78877da1a

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 3KB - Virtual size: 3KB