ad186e22431918e673baa22bfcf85d6f6a39966fc5d997ccada96a51a1987d57

Sharing

Copy URL Twitter E-mail

General

Target

ad186e22431918e673baa22bfcf85d6f6a39966fc5d997ccada96a51a1987d57
Size

83KB
MD5

d3bb24d45d15cf3b5f98a6ded251c46b
SHA1

33fc44d4d3c70a079a35fa330c2de18e46a65b11
SHA256

ad186e22431918e673baa22bfcf85d6f6a39966fc5d997ccada96a51a1987d57
SHA512

126d931a2579efcef563abba7baf09c100b7e95bb0fff54b62a6dee676469c6ef42901841d7cfafb851160a1478bb402522c0e7d260aa84907216f40876ee617
SSDEEP

1536:m5cSEMqFDfJ9BAJ6Hwsx6guj3r5w31k1SSX4GLdA8KRNb3SPKK:q/EMoN9Hws4guzrG2SSIQA8K7zSP9

Score

N/A

Malware Config

Signatures

Files

ad186e22431918e673baa22bfcf85d6f6a39966fc5d997ccada96a51a1987d57
.exe windows x86

5071f3085054ba8f6382796b6cc13ae3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_allmul
ZwClose
ZwSetValueKey
ZwCreateKey
ExFreePoolWithTag
ZwQueryValueKey
ExAllocatePool
ZwOpenKey
memset
ZwDeleteValueKey
ZwCreateFile
ZwReadFile
ZwWriteFile
ZwQueryInformationFile
ZwSetInformationFile
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwEnumerateKey
ObfDereferenceObject
KeWaitForSingleObject
KeSetEvent
atol
PsTerminateSystemThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeEvent
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
_alldiv
IoDetachDevice
IofCallDriver
RtlCompareMemory
MmIsAddressValid
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
PsGetCurrentProcessId
_except_handler3
atoi
strstr
ObfReferenceObject
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
IoAllocateIrp
IoCancelIrp
PsGetCurrentThreadId
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
ZwDeviceIoControlFile
ZwFsControlFile
ZwWaitForSingleObject
KeSetPriorityThread
KeGetCurrentThread
DbgPrint
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExInitializeNPagedLookasideList
RtlVolumeDeviceToDosName
RtlCopyUnicodeString
ObQueryNameString
ExQueueWorkItem
IoGetTopLevelIrp
PsGetVersion
IoGetAttachedDeviceReference
RtlEqualUnicodeString
MmGetSystemRoutineAddress
IoRegisterFsRegistrationChange
KeTickCount
KeQueryTimeIncrement
memmove
memcpy
strchr
_vsnwprintf
IoGetDeviceObjectPointer
_vsnprintf

hal

KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.v-lizer
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5071f3085054ba8f6382796b6cc13ae3

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 29KB

PAGE Size: 6KB - Virtual size: 5KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 768B

.v-lizer Size: 25KB - Virtual size: 25KB

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 29KB

PAGE
Size: 6KB - Virtual size: 5KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 768B

.v-lizer
Size: 25KB - Virtual size: 25KB