7e339e9b98e68a6ecddec1e97684a5ee533d68eb744acb7fba21ac2f0b6a28f1

General

Target

7e339e9b98e68a6ecddec1e97684a5ee533d68eb744acb7fba21ac2f0b6a28f1
Size

18KB
MD5

0522cc20f03f12df516328d5b536cb75
SHA1

b81e6a3823f4a05a4778aeed8f2487f9d7278a60
SHA256

7e339e9b98e68a6ecddec1e97684a5ee533d68eb744acb7fba21ac2f0b6a28f1
SHA512

4bf75103dd33a08a89e4514a7f89be48a69e1b8357e9192778edbdfcac6abb5f7e5b0cebd15b4bf6166bbf0d7c23f2145472d6025c1d66a7dee1ab8a0810becd
SSDEEP

384:AFXFw5NdfKU3K+xS+Wr6+g9PflDnjLQK:Qwj4a9SYb1nE

Score

N/A

Malware Config

Signatures

Files

7e339e9b98e68a6ecddec1e97684a5ee533d68eb744acb7fba21ac2f0b6a28f1
.exe windows x86

e6336f9fde937aae8dcbfb1e25f9c6cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memmove
ObfDereferenceObject
ExFreeToPagedLookasideList
RtlFreeAnsiString
strncmp
strncat
RtlUnicodeStringToAnsiString
ObQueryNameString
ExFreePool
ExAllocateFromPagedLookasideList
ExAllocatePoolWithTag
_except_handler3
IoGetCurrentProcess
strncpy
wcscpy
wcsstr
_strupr
wcslen
_strnicmp
PsGetCurrentProcessId
ObReferenceObjectByHandle
ZwEnumerateKey
InterlockedExchange
KeServiceDescriptorTable
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
ExDeletePagedLookasideList
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoRegisterShutdownNotification
ExInitializePagedLookasideList
IoCreateSymbolicLink
IoCreateDevice
MmUnmapLockedPages
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 672B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 576B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6336f9fde937aae8dcbfb1e25f9c6cb

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 384B - Virtual size: 364B

.data Size: 672B - Virtual size: 668B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 576B - Virtual size: 556B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 384B - Virtual size: 364B

.data
Size: 672B - Virtual size: 668B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 576B - Virtual size: 556B