beef1b80ec1f7b741cad35b05d1db2011cc51dd9d604fb6e9b54ea2cf7a1a16d

Sharing

Copy URL Twitter E-mail

General

Target

beef1b80ec1f7b741cad35b05d1db2011cc51dd9d604fb6e9b54ea2cf7a1a16d
Size

22KB
MD5

84c0cbe9a1d98ab81c468e75f8a54afc
SHA1

14278b854efdc3e3ff9b476019ac876d88514f0e
SHA256

beef1b80ec1f7b741cad35b05d1db2011cc51dd9d604fb6e9b54ea2cf7a1a16d
SHA512

67192c5bd07f6dec905842a87e5bfc528d76ce937edb48cb36172fe04cc824e00d42aba21a623ac0382b7124fef6def6b9558aab965bdc9474c774a547b97d50
SSDEEP

384:++4bT4uApLRNvU6A8FV95Aze8IcYK2VdndKpoywfuuS+2091IVsO+lMdo/aBi57z:++k03LDd7FGzIC

Score

N/A

Malware Config

Signatures

Files

beef1b80ec1f7b741cad35b05d1db2011cc51dd9d604fb6e9b54ea2cf7a1a16d
.exe windows x86

56d7b802320bf0e1abb78776fb3907eb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ZwClose
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
_strlwr
_strupr
strrchr
_stricmp
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
RtlFreeUnicodeString
_except_handler3

hal

KeGetCurrentIrql

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 832B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

w8ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w7ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w6ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w5ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w4ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w3ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w2ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

w1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 832B - Virtual size: 804B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56d7b802320bf0e1abb78776fb3907eb

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 832B - Virtual size: 832B

.data Size: 10KB - Virtual size: 10KB

w8ata Size: 512B - Virtual size: 512B

w7ata Size: 512B - Virtual size: 512B

w6ata Size: 512B - Virtual size: 512B

w5ata Size: 512B - Virtual size: 512B

w4ata Size: 512B - Virtual size: 512B

w3ata Size: 512B - Virtual size: 512B

w2ata Size: 512B - Virtual size: 512B

w1ata Size: 512B - Virtual size: 512B

INIT Size: 832B - Virtual size: 804B

.reloc Size: 608B - Virtual size: 600B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 832B - Virtual size: 832B

.data
Size: 10KB - Virtual size: 10KB

w8ata
Size: 512B - Virtual size: 512B

w7ata
Size: 512B - Virtual size: 512B

w6ata
Size: 512B - Virtual size: 512B

w5ata
Size: 512B - Virtual size: 512B

w4ata
Size: 512B - Virtual size: 512B

w3ata
Size: 512B - Virtual size: 512B

w2ata
Size: 512B - Virtual size: 512B

w1ata
Size: 512B - Virtual size: 512B

INIT
Size: 832B - Virtual size: 804B

.reloc
Size: 608B - Virtual size: 600B