9087d3d87c4b51ce833ab6bf30e5524126c1726e9f769c076ef383779db61aea

General

Target

9087d3d87c4b51ce833ab6bf30e5524126c1726e9f769c076ef383779db61aea
Size

19KB
MD5

4d848ed00757673813f07b45c8a06da0
SHA1

9a7a3d5ccf0e59fb7e29b5fd43a40045eb7c353a
SHA256

9087d3d87c4b51ce833ab6bf30e5524126c1726e9f769c076ef383779db61aea
SHA512

a469e5f0d399ad8151581fb7e8344aad098bf70ab0377714571ee20f5589b3929fb4ecc2b55fd21c9c8d710c166463fb952655d8f054b16a7d850868c0df7926
SSDEEP

384:q9v3EyuvymGVCa5MIMo8iPjyf6gUGBoPcnZeBma+2kofTBzIX9twd81rPDDR+/2F:4CGG+vITf

Score

N/A

Malware Config

Signatures

Files

9087d3d87c4b51ce833ab6bf30e5524126c1726e9f769c076ef383779db61aea
.exe windows x86

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQueryInformationProcess
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwClose
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zcata
Size: 544B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

vcata
Size: 544B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 992B - Virtual size: 982B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 416B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 16KB

zcata Size: 544B - Virtual size: 520B

vcata Size: 544B - Virtual size: 520B

INIT Size: 992B - Virtual size: 982B

.reloc Size: 416B - Virtual size: 388B

.text
Size: 16KB - Virtual size: 16KB

zcata
Size: 544B - Virtual size: 520B

vcata
Size: 544B - Virtual size: 520B

INIT
Size: 992B - Virtual size: 982B

.reloc
Size: 416B - Virtual size: 388B