54d6c5a8cd3e0c59887ef8dbae73c1ff6fea8ec5dd22277bef1d90cf35e330d3

Sharing

Copy URL Twitter E-mail

General

Target

54d6c5a8cd3e0c59887ef8dbae73c1ff6fea8ec5dd22277bef1d90cf35e330d3
Size

23KB
MD5

03b80f9baca126b21f7a2c0e19cc55f1
SHA1

64ddf43b7dd6253cb1e32bbeade8f023f37c8e19
SHA256

54d6c5a8cd3e0c59887ef8dbae73c1ff6fea8ec5dd22277bef1d90cf35e330d3
SHA512

a463b5a4acb1ef9f0fb45bc3b1aa93144c6975a7811cf1d390fa7a5fde46ddda1a79e12c3fb66704596dbb14dd8c086cb3909c0298a30fdffbdd9f6dfa4794d8
SSDEEP

384:HYQfgpWKTX6OANp6w1WdTtvR7AzOCrZ00pqwWDBiFh:Hn4EKb6OArvWdBUJCi

Score

N/A

Malware Config

Signatures

Files

54d6c5a8cd3e0c59887ef8dbae73c1ff6fea8ec5dd22277bef1d90cf35e330d3
.exe windows x86

ae47640f17f0271d09fdaeab4b0346d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoOpenDeviceRegistryKey
IoReleaseRemoveLockEx
IofCompleteRequest
IoReleaseCancelSpinLock
IoAcquireRemoveLockEx
KeSetEvent
KeWaitForSingleObject
KeInitializeEvent
memmove
RtlCopyUnicodeString
RtlQueryRegistryValues
RtlAppendUnicodeToString
ObfDereferenceObject
IoRegisterPlugPlayNotification
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoBuildDeviceIoControlRequest
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoUnregisterPlugPlayNotification
IoFreeWorkItem
DbgPrint
IoQueueWorkItem
IoAllocateWorkItem
PoCallDriver
ZwClose
PoSetPowerState
PoRequestPowerIrp
SeSinglePrivilegeCheck
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PoSetSystemState
IoDeleteDevice
RtlFreeUnicodeString
KeInitializeSpinLock
IoInitializeRemoveLockEx
IoCreateDevice
IoSetDeviceInterfaceState
IoWMIRegistrationControl
IoCancelIrp
ZwSetValueKey
RtlWriteRegistryValue
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoRegisterDeviceInterface
IoAttachDeviceToDeviceStack
IoRegisterDriverReinitialization
KeTickCount
KeBugCheckEx
VerSetConditionMask
RtlVerifyVersionInfo
ZwPowerInformation
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwQueryValueKey
ExFreePoolWithTag
PoStartNextPowerIrp
IofCallDriver

hal

KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfReleaseSpinLock

wmilib.sys

WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 417B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 896B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae47640f17f0271d09fdaeab4b0346d2

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wmilib.sys

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 512B - Virtual size: 417B

.data Size: 896B - Virtual size: 868B

PAGE Size: 5KB - Virtual size: 5KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 417B

.data
Size: 896B - Virtual size: 868B

PAGE
Size: 5KB - Virtual size: 5KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB