080c207863a5d729a21c48c8e431d4cfe1dc69c109599845b4a77574b7b1d90a

Sharing

Copy URL Twitter E-mail

General

Target

080c207863a5d729a21c48c8e431d4cfe1dc69c109599845b4a77574b7b1d90a
Size

50KB
MD5

911ba699e8c219ddaa8a050429f3255c
SHA1

1ef9227fc3e9a8eee74ee5e5707099908eb8929e
SHA256

080c207863a5d729a21c48c8e431d4cfe1dc69c109599845b4a77574b7b1d90a
SHA512

f7cf5aa4097244ccde1d0a2e8083c96583f3928404a77331a9418924f3acaaab8b2b47fcad3986b676d52dae1846f4adb94ad8320ec748b85011b6a5cb104006
SSDEEP

768:Toa6ybqRphW2jlt1nOE3OqLATgHCF3JzzAp2X:TJqRfW2RnOJPP1X

Score

N/A

Malware Config

Signatures

Files

080c207863a5d729a21c48c8e431d4cfe1dc69c109599845b4a77574b7b1d90a
.exe windows x64

6602afb210203c2a35294b61d753a900

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoDetachDevice
PoSetPowerState
ExFreePool
RtlFreeAnsiString
RtlWriteRegistryValue
IoAttachDeviceToDeviceStack
IoIsWdmVersionAvailable
IoCreateSymbolicLink
IoCreateDevice
KeInitializeTimerEx
KeClearEvent
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
IoSetDeviceInterfaceState
KeSetEvent
IoFreeWorkItem
RtlQueryRegistryValues
KeReleaseSpinLock
KeSetTimerEx
IoCancelIrp
RtlFreeUnicodeString
KeInitializeDpc
IofCompleteRequest
KeWaitForSingleObject
IoQueueWorkItem
KeCancelTimer
IofCallDriver
KeAcquireSpinLockRaiseToDpc
PoRequestPowerIrp
PoStartNextPowerIrp
PoCallDriver
MmMapLockedPagesSpecifyCache
IoFreeIrp
IoAllocateIrp
IoWMIRegistrationControl
MmUnmapLockedPages
IoBuildPartialMdl
IoFreeMdl
IoAllocateMdl
IoInitializeIrp
KeBugCheckEx
RtlUnicodeStringToAnsiString
IoDeleteDevice
KeInitializeEvent
RtlInitUnicodeString
IoRegisterDeviceInterface
IoAllocateWorkItem
ExAllocatePoolWithTag

wmilib.sys

WmiSystemControl
WmiCompleteRequest

usbd.sys

USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_GetUSBDIVersion

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6602afb210203c2a35294b61d753a900

Headers

File Characteristics

Imports

ntoskrnl.exe

wmilib.sys

usbd.sys

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 17KB - Virtual size: 20KB

.pdata Size: 1024B - Virtual size: 996B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 17KB - Virtual size: 20KB

.pdata
Size: 1024B - Virtual size: 996B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B