84f54d9aaaaa07c7e20ffe5907b0a00cb990cdcfa77b7fd86be3aa790aa9b114

Sharing

Copy URL Twitter E-mail

General

Target

84f54d9aaaaa07c7e20ffe5907b0a00cb990cdcfa77b7fd86be3aa790aa9b114
Size

20KB
MD5

4aae89b9c90a9602d4ccede3ddb1292a
SHA1

cf7910a537ad8b2b8ef189cd1594fbcec5364722
SHA256

84f54d9aaaaa07c7e20ffe5907b0a00cb990cdcfa77b7fd86be3aa790aa9b114
SHA512

a13e85da0269aa51931870b02b8a49a0aaa154e694f97643cf5ef2381d8735d16a348efd531365880ceb45ab26a7579499b08a818da67b3b6aab2f97148161cc
SSDEEP

384:9QPnyrLeMDnMGQ7mBig4Aig3R7kgTN9PELbYJJAz/9IqNuk3n89ft/bNPb:9pGMDMGxiAB7kgTbs/YJWpEhP

Score

N/A

Malware Config

Signatures

Files

84f54d9aaaaa07c7e20ffe5907b0a00cb990cdcfa77b7fd86be3aa790aa9b114
.exe windows x86

c309c5ff2a129706dbda3f6ab5c2c3ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeBugCheckEx
KeTickCount
MmMapLockedPagesSpecifyCache
IoFreeMdl
IoReleaseCancelSpinLock
RtlUnicodeStringToInteger
IoDeleteDevice
IoCreateSymbolicLink
KeInitializeSpinLock
IofCompleteRequest
RtlInitUnicodeString
IoDeleteSymbolicLink
MmGetSystemRoutineAddress
wcslen
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
ExFreePoolWithTag
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
ExAllocatePoolWithTag
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString

hal

KfReleaseSpinLock
KfAcquireSpinLock

ndis.sys

NdisUnchainBufferAtFront
NdisFreePacket
NdisReturnPackets
NdisAllocatePacket
NdisReadConfiguration
NdisCloseConfiguration
NdisAllocateMemoryWithTag
NdisAllocatePacketPoolEx
NdisAllocateBufferPool
NdisCancelSendPackets
NdisOpenProtocolConfiguration
NdisAllocateBuffer
NdisFreeMemory
NdisWaitEvent
NdisGeneratePartialCancelId
NdisRegisterProtocol
NdisInitializeEvent
NdisSetEvent
NdisFreeBufferPool
NdisFreePacketPool
NdisQueryPendingIOCount
NdisDeregisterProtocol
NdisRequest
NdisCloseAdapter
NdisQueryAdapterInstanceName
NdisOpenAdapter

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 938B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c309c5ff2a129706dbda3f6ab5c2c3ed

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

ndis.sys

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 492B

PAGE Size: 5KB - Virtual size: 5KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 1024B - Virtual size: 938B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 492B

PAGE
Size: 5KB - Virtual size: 5KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 1024B - Virtual size: 938B