afd51901e6cdd03c71fd5b08395d28da5c1a97594187c5f79745662b621c7582

General

Target

afd51901e6cdd03c71fd5b08395d28da5c1a97594187c5f79745662b621c7582
Size

18KB
MD5

f6ed55fcf5bb45002fc824fbd5aad22c
SHA1

7c03bd945c211c03fb7e858f3c4f1ac61d3ac41e
SHA256

afd51901e6cdd03c71fd5b08395d28da5c1a97594187c5f79745662b621c7582
SHA512

3be8a2216c7a720ae62df1267b780bfdeef44eb833885c44bb93f05ef3639ce8e396048f6d55cb3806f107a8ab48bf0550b82d62aa18bbaa7a7372d5c456f77e
SSDEEP

384:q9v3EyuvymGtyShEwkwUqXLKnyYMepQH0PBGZui2eMwHbZ7wvVF4N09z3b71+7Qo:4CGy+UV76f

Score

N/A

Malware Config

Signatures

Files

afd51901e6cdd03c71fd5b08395d28da5c1a97594187c5f79745662b621c7582
.exe windows x86

45876e02e389f49e8bdd873e468a6de0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ProbeForRead
_except_handler3
_stricmp
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ProbeForWrite
ExAllocatePoolWithTag
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
ZwQueryInformationProcess
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
PsTerminateSystemThread
MmIsAddressValid
ExFreePool
ExGetPreviousMode

hal

KfAcquireSpinLock
KeQueryPerformanceCounter

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zcata
Size: 544B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

vcata
Size: 544B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 378B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45876e02e389f49e8bdd873e468a6de0

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 15KB - Virtual size: 15KB

zcata Size: 544B - Virtual size: 520B

vcata Size: 544B - Virtual size: 520B

INIT Size: 1024B - Virtual size: 1000B

.reloc Size: 384B - Virtual size: 378B

.text
Size: 15KB - Virtual size: 15KB

zcata
Size: 544B - Virtual size: 520B

vcata
Size: 544B - Virtual size: 520B

INIT
Size: 1024B - Virtual size: 1000B

.reloc
Size: 384B - Virtual size: 378B