922b95710f88d1c291dfef99262a65add44b90c8111f6cad82baade8b286ffca

General

Target

922b95710f88d1c291dfef99262a65add44b90c8111f6cad82baade8b286ffca
Size

125KB
MD5

5daa66a82cb63ddc2fa3e4079ed75922
SHA1

a566817800a87a45681e30e7636e0a06b56eaf6e
SHA256

922b95710f88d1c291dfef99262a65add44b90c8111f6cad82baade8b286ffca
SHA512

4d529cab4be95cd245e4bc9dc6ae0d0d34ed778a9716a0f8850adae616340ec594871c1377b119c757a24a4f097d0652f1577cb265b3c671d1d2ecd0c316c08f
SSDEEP

1536:ypq0c+706g/r2Oayw4dPN//e8f3nIQ6gL46OL9j3vFDehP/9cFsFYi5ck:ypqQ4D2143hf3ITgL4L5j31O

Score

N/A

Malware Config

Signatures

Files

922b95710f88d1c291dfef99262a65add44b90c8111f6cad82baade8b286ffca
.exe windows x86

4ce6626b0cd2ff43ff328d42bc486fd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
KeWaitForSingleObject
KeSetEvent
IoDeleteDevice
IoDeleteSymbolicLink
ZwClose
PsTerminateSystemThread
DbgPrint
KeResetEvent
IoCreateNotificationEvent
RtlInitUnicodeString
ObReferenceObjectByHandle
PsCreateSystemThread
NtBuildNumber
IoCreateSymbolicLink
IoCreateDevice
wcsstr
ExFreePoolWithTag
ExAllocatePoolWithTag
IoGetDeviceObjectPointer
ObfDereferenceObject
_wcslwr
wcsncpy
PsLookupThreadByThreadId
wcscmp
ZwQuerySystemInformation
ZwAllocateVirtualMemory
KeDetachProcess
ZwOpenProcess
KeAttachProcess
PsLookupProcessByProcessId
KeInitializeEvent
KeServiceDescriptorTable
KeInsertQueueApc
KeInitializeApc
KeTickCount
KeBugCheckEx

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 768B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ce6626b0cd2ff43ff328d42bc486fd7

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 256B - Virtual size: 256B

.data Size: 118KB - Virtual size: 118KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 768B - Virtual size: 744B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 256B - Virtual size: 256B

.data
Size: 118KB - Virtual size: 118KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 768B - Virtual size: 744B