abfb5f72a83ca30fd174f370cc774b2337abffd4de0c772b9c7469ffd18443f4

General

Target

abfb5f72a83ca30fd174f370cc774b2337abffd4de0c772b9c7469ffd18443f4
Size

39KB
MD5

c629fce7410b28b3ef997343fa011263
SHA1

4cdc4560380afd1e82bc0bea725f901c52c2b922
SHA256

abfb5f72a83ca30fd174f370cc774b2337abffd4de0c772b9c7469ffd18443f4
SHA512

d1c1e23c1e1f57084bf03d729c0e13ef2e4d7789cc938bd6b0c58596d74df0ab21d5b339c59c91ae076edd528c738c74b2424bb9cf70c9eda0ae76ae5f613e9d
SSDEEP

768:g/uiflgoBr7fi0sUYqUIrj0CPV7QeycfIqZ7r1mqMrSmuvpQWwNyg/oUg3LHwiwL:g2ifTBr7fJY/mZ1Qeyax1mBwpQZsg/uO

Score

N/A

Malware Config

Signatures

Files

abfb5f72a83ca30fd174f370cc774b2337abffd4de0c772b9c7469ffd18443f4
.exe windows x86

18c97a9637b7079ea658ad68a4354e22

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncpy
IoGetCurrentProcess
ObfDereferenceObject
wcsncpy
MmIsAddressValid
PsGetVersion
ZwQueryValueKey
RtlInitUnicodeString
IoDeviceObjectType
ExFreePool
ExAllocatePoolWithTag
ZwClose
_snprintf
strncmp
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
ObReferenceObjectByHandle
_wcsicmp
wcscat
ZwOpenKey
wcsrchr
ZwDeleteKey
ZwSetValueKey
ZwCreateKey
KeDelayExecutionThread
KeQuerySystemTime
PsSetCreateProcessNotifyRoutine
wcsstr
_wcslwr
_except_handler3
IofCompleteRequest
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
_wcsnicmp
_snwprintf
wcschr
IoRegisterDriverReinitialization
RtlCompareUnicodeString
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
_stricmp
PsCreateSystemThread
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 96B - Virtual size: 65B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

18c97a9637b7079ea658ad68a4354e22

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 6KB

PAGE Size: 96B - Virtual size: 65B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 6KB

PAGE
Size: 96B - Virtual size: 65B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB