4b5f645c9dc3cf44f49ade78602b0b659ee721d4811610467373d8cfacd907c1

General

Target

4b5f645c9dc3cf44f49ade78602b0b659ee721d4811610467373d8cfacd907c1
Size

18KB
MD5

3448b199fddb8b000e58566c9f9a2cb5
SHA1

d6e45e5b4bd2c963cf16b40e17cdd7676d886a8a
SHA256

4b5f645c9dc3cf44f49ade78602b0b659ee721d4811610467373d8cfacd907c1
SHA512

e2801e0105a49c60cd7afa482c62cd98721b4e0407292f4e0e1c4f55ae6680c98abf27cba4e05494f14632e48e231ea60d0a17c5fa3a256066f6e66be7a12128
SSDEEP

384:sia9Uyo0qwbAvYiEW8LFXteAm1zk3fOX9:sia9LMvYiqcnEy

Score

N/A

Malware Config

Signatures

Files

4b5f645c9dc3cf44f49ade78602b0b659ee721d4811610467373d8cfacd907c1
.exe windows x86

1881cbf48dc1acd1550e6ac95fe5bf93

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IofCompleteRequest
MmIsAddressValid
NtBuildNumber
_stricmp
ObfDereferenceObject
PsLookupProcessByProcessId
ZwClose
ZwCreateFile
ObReferenceObjectByName
IoDriverObjectType
_wcsnicmp
wcslen
ExFreePool
wcsstr
ExAllocatePoolWithTag
wcscpy
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
MmUnlockPages
wcsrchr
_wcslwr
ZwUnmapViewOfSection
ZwEnumerateKey
ZwMapViewOfSection
ZwCreateSection
swprintf
KeServiceDescriptorTable
strncmp
IoGetCurrentProcess
strncpy
ZwSetValueKey
ZwOpenKey
wcsncmp
ZwQueryValueKey
_wcsicmp
DbgPrint
wcsncpy

hal

KeRaiseIrqlToDpcLevel
KfLowerIrql

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1881cbf48dc1acd1550e6ac95fe5bf93

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 320B - Virtual size: 308B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 896B - Virtual size: 872B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 320B - Virtual size: 308B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 896B - Virtual size: 872B