420fa8f6efde018b2343be1185641457d42d05156dc100392a119151800027ef

General

Target

420fa8f6efde018b2343be1185641457d42d05156dc100392a119151800027ef
Size

160KB
MD5

ff28b9cb95ed70035e8851c3c66ede34
SHA1

a5f6c128d076880553232b4f20e8df94ba8c51cf
SHA256

420fa8f6efde018b2343be1185641457d42d05156dc100392a119151800027ef
SHA512

a5619eb3f4291b1e8bd2cdb8c38a9fc312d8d2068b685893b07f76e438c3535a74940d117d0728e67d2bd0c4d161efe2691939faa15689989b46dc4454543e7d
SSDEEP

3072:Zy73DLP6aG8jGJ63HkW1l0kInfeRlu0Q4pahDBWQmPHZOlQj0CyWsqRL7EWn2Ui+:Zy7TLiaRGJ9W0tcjQ4pahdmElk0+L7E8

Score

N/A

Malware Config

Signatures

Files

420fa8f6efde018b2343be1185641457d42d05156dc100392a119151800027ef
.exe windows x86

7c3b17afd6d283cc40120952f7a38fc9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ntoskrnl.exe

IoRegisterDeviceInterface
ExAllocatePoolWithTag
ExEventObjectType
MmResetDriverPaging
IoStopTimer
InbvDisplayString
RtlDeleteRegistryValue
MmUnmapIoSpace
ZwFlushKey
IoCreateDriver
RtlRaiseException
IoAllocateMdl
MmIsVerifierEnabled
RtlMultiByteToUnicodeN
IoDeleteDevice
PsTerminateSystemThread
_strupr
IoGetTopLevelIrp
IoUnregisterPlugPlayNotification
ZwSaveKey
RtlFindLeastSignificantBit
IoGetDeviceInterfaces
_allshl
PsCreateSystemThread
IoConnectInterrupt
RtlUnicodeStringToInteger
IoGetConfigurationInformation
IoInitializeRemoveLockEx
IoGetDeviceAttachmentBaseRef
InterlockedCompareExchange
ExInitializeNPagedLookasideList
IoInvalidateDeviceState
KeReadStateSemaphore
ExAcquireResourceSharedLite
CcFlushCache
KeNumberProcessors
KdDebuggerEnabled
MmUserProbeAddress
KeInitializeTimerEx
IoWriteErrorLogEntry
KeSynchronizeExecution
SeQueryAuthenticationIdToken
PsGetCurrentProcessId
SeCaptureSubjectContext
FsRtlFastUnlockSingle
KeInitializeSemaphore
MmFreeContiguousMemory
RtlInitString

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 58B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c3b17afd6d283cc40120952f7a38fc9

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 13KB - Virtual size: 13KB

.edata Size: 146KB - Virtual size: 146KB

.reloc Size: 256B - Virtual size: 58B

.text
Size: 13KB - Virtual size: 13KB

.edata
Size: 146KB - Virtual size: 146KB

.reloc
Size: 256B - Virtual size: 58B