6b372fa6134e4039e0e5a21b3a1de8fa9539b7bc760ab9ae608c179d5341a15b

General

Target

6b372fa6134e4039e0e5a21b3a1de8fa9539b7bc760ab9ae608c179d5341a15b
Size

15KB
MD5

ff9ea6ee1e19316edbb0bde797267a90
SHA1

f5ca2df8df7c4a555a25d6567aadd7e45b764e67
SHA256

6b372fa6134e4039e0e5a21b3a1de8fa9539b7bc760ab9ae608c179d5341a15b
SHA512

15b599a3161f1ebd06cde370fd6654c38d27cc11496529a2f6e9ace0f1b04aa97f33803751715da7074c16ff390e3e655587a3a1cb6b4a68a120f7cc3ea29476
SSDEEP

192:yq7r3+tur0nRvMoeyPkUtSvQV12fNFtAxUuQe2IQ4kLntlq3Kd:yq7j6sGvnVYf1KQlq3Kd

Score

N/A

Malware Config

Signatures

Files

6b372fa6134e4039e0e5a21b3a1de8fa9539b7bc760ab9ae608c179d5341a15b
.exe windows x86

e8704d6182f9efa68cc6e906e6443473

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnlockPages
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
_stricmp
strrchr
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObfDereferenceObject
IoDriverObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeSetEvent
ZwReadFile
ZwQueryInformationFile
KeWaitForSingleObject
KeGetCurrentThread
MmProbeAndLockPages
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
IoGetCurrentProcess
ObReferenceObjectByHandle
IoFileObjectType
_allmul
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
ZwClose
IoFreeIrp

hal

KeStallExecutionProcessor

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896B - Virtual size: 813B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mcata
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8704d6182f9efa68cc6e906e6443473

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 896B - Virtual size: 813B

.data Size: 4KB - Virtual size: 4KB

mcata Size: 640B - Virtual size: 520B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 520B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 896B - Virtual size: 813B

.data
Size: 4KB - Virtual size: 4KB

mcata
Size: 640B - Virtual size: 520B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 520B