a41e58bb9a1e3b23a5dad41b0c178e4815108be05b787c4de0d1475de4d5bd35

General

Target

a41e58bb9a1e3b23a5dad41b0c178e4815108be05b787c4de0d1475de4d5bd35
Size

15KB
MD5

6e700c887e47f7de8f0f0a7b5c6306a4
SHA1

789ff8f600099bdddd8b777500aae2066e10f012
SHA256

a41e58bb9a1e3b23a5dad41b0c178e4815108be05b787c4de0d1475de4d5bd35
SHA512

21b3b5dc8a9a990a1b2a9b1375ad71e0e5ba608d033e3ea5fc6f5c4b389b98c95f248c7ae889fd62da9e01f01468eef9e6c4c018b9489f391a19fb2ac4fdfb43
SSDEEP

192:Xzs1AchqdeEejDHonGHypk4fgY0HbX5uxCQOl2AeyPkU15L3DGC/VDDsFpCWI:XzcAvxs+k4fgxFusQ25LdVf2nI

Score

N/A

Malware Config

Signatures

Files

a41e58bb9a1e3b23a5dad41b0c178e4815108be05b787c4de0d1475de4d5bd35
.exe windows x86

cecd5d68bb496dc00d13b2875b82616b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
DbgPrint
KeGetCurrentThread
ProbeForRead
_except_handler3
KeWaitForSingleObject
RtlAssert
MmProbeAndLockPages
IoFreeIrp
ExFreePoolWithTag
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
KdDisableDebugger
ExAllocatePoolWithTag
KeSetEvent
IoFreeMdl
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
_stricmp
strrchr
ZwQuerySystemInformation
ObfDereferenceObject
IoDriverObjectType
IofCompleteRequest
IoCreateFile
ZwClose
ObReferenceObjectByHandle
IoFileObjectType
ZwReadFile
_allmul
ZwQueryInformationFile
MmIsAddressValid
MmUnlockPages
IoGetCurrentProcess

hal

KeGetCurrentIrql
KeStallExecutionProcessor

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896B - Virtual size: 881B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 614B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 768B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cecd5d68bb496dc00d13b2875b82616b

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 896B - Virtual size: 881B

.data Size: 640B - Virtual size: 614B

INIT Size: 1024B - Virtual size: 1016B

.reloc Size: 768B - Virtual size: 660B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 896B - Virtual size: 881B

.data
Size: 640B - Virtual size: 614B

INIT
Size: 1024B - Virtual size: 1016B

.reloc
Size: 768B - Virtual size: 660B