accc05e324518ce848a2b41897c266e50931c46c7511f8196c392b2a864c04be

General

Target

accc05e324518ce848a2b41897c266e50931c46c7511f8196c392b2a864c04be
Size

35KB
MD5

eede1be690913282448212528edff58c
SHA1

8c4ab13c816fde27467e0c2e6b69b820e0c351d8
SHA256

accc05e324518ce848a2b41897c266e50931c46c7511f8196c392b2a864c04be
SHA512

f20385bbae23f773c18abc7b8588c876ea86b1c98bd7751d819262bb7c91043e1cab36668085360caf3be5eff84d6b2f7fbb710b65f6fcf5d567c9a6a06088da
SSDEEP

768:6H1BVYcq2h7T/C4XFDXCc1Yy4PlNoX08dSv87y884BW:6VBmcz77FDyvXPlWXuv8u88z

Score

N/A

Malware Config

Signatures

Files

accc05e324518ce848a2b41897c266e50931c46c7511f8196c392b2a864c04be
.exe windows x86

bbaf8594ef4aaed4fef92bfdcd589afa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
_stricmp
ZwQueryValueKey
RtlInitUnicodeString
MmIsAddressValid
strncmp
IoGetCurrentProcess
ZwClose
swprintf
ZwQueryKey
ZwOpenKey
ObReferenceObjectByHandle
_wcsicmp
wcsncpy
wcslen
wcsrchr
ZwSetValueKey
_except_handler3
ZwSetInformationFile
ZwCreateFile
wcscpy
PsCreateSystemThread
wcscat
KeTickCount
ZwDeleteKey
_wcsnicmp
wcsstr
_wcslwr
MmGetSystemRoutineAddress
IoDeviceObjectType
RtlCopyUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
strncpy
RtlCompareUnicodeString
ObfDereferenceObject
ObQueryNameString
KeQueryTimeIncrement
KeDelayExecutionThread
KeQuerySystemTime
_snwprintf
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwCreateKey
wcschr

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 54B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 640B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbaf8594ef4aaed4fef92bfdcd589afa

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 25KB - Virtual size: 24KB

.data Size: 5KB - Virtual size: 5KB

PAGE Size: 64B - Virtual size: 54B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 640B - Virtual size: 616B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 25KB - Virtual size: 24KB

.data
Size: 5KB - Virtual size: 5KB

PAGE
Size: 64B - Virtual size: 54B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 640B - Virtual size: 616B

.reloc
Size: 1KB - Virtual size: 1KB