ad02a33fd3766bdacbd2885ba2f5a9126c6270a455ef4b75d991009fab97c14b

General

Target

ad02a33fd3766bdacbd2885ba2f5a9126c6270a455ef4b75d991009fab97c14b
Size

21KB
MD5

e1c77a214bae971df45a8de6e2b3c025
SHA1

a1665483fbc8bab9a1329c177122ff290a64ddff
SHA256

ad02a33fd3766bdacbd2885ba2f5a9126c6270a455ef4b75d991009fab97c14b
SHA512

4dc3ec4d7455a25099f4df233eba4b6586b51af0830658a1a42483846156680a448548c631411343452a5275d4135fb73ea63e2dc6d55d14c334ec7dbbe22ef4
SSDEEP

384:jP337qI5cBZ7mvzEAehl/FTs0TZEdV56jN5MecX+TrxyrQlv:jP3L7cBuz2dFWz565cX+TrBv

Score

N/A

Malware Config

Signatures

Files

ad02a33fd3766bdacbd2885ba2f5a9126c6270a455ef4b75d991009fab97c14b
.exe windows x86

b031864c7de75ccdddd12eec59c02fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
_wcsnicmp
wcslen
strncmp
IoGetCurrentProcess
strncpy
RtlCopyUnicodeString
PsCreateSystemThread
_snwprintf
ExAllocatePoolWithTag
wcsncpy
wcschr
ExFreePool
RtlConvertSidToUnicodeString
ZwQueryInformationToken
ObfDereferenceObject
ObOpenObjectByPointer
PsReferencePrimaryToken
MmGetSystemRoutineAddress
_wcsicmp
wcsrchr
ZwDeleteKey
swprintf
ZwOpenKey
ZwSetValueKey
ZwCreateKey
ZwSetInformationFile
wcscpy
wcsstr
_wcslwr
MmIsAddressValid
ObReferenceObjectByHandle
_stricmp
ZwQueryValueKey
RtlCompareUnicodeString
ObQueryNameString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
PsLookupProcessByProcessId
KeQuerySystemTime
_except_handler3
ZwEnumerateKey
ZwQueryKey
KeDelayExecutionThread
RtlAnsiStringToUnicodeString
_snprintf

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b031864c7de75ccdddd12eec59c02fab

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB