5d5f39f08e1e0fb32bcd64145ac69089faa076fa0fc48dfcf773f78af89f05dc

Sharing

Copy URL Twitter E-mail

General

Target

5d5f39f08e1e0fb32bcd64145ac69089faa076fa0fc48dfcf773f78af89f05dc
Size

30KB
MD5

df886c3b4d93afc5d106d72ef26ae727
SHA1

f4ea6bbfd1c032f975a78ee48aa63fcf3a598a4d
SHA256

5d5f39f08e1e0fb32bcd64145ac69089faa076fa0fc48dfcf773f78af89f05dc
SHA512

8e01b0cf3d5314133f490ac6106cad9d0d3c2e4ab1f4a4cbf7871010f8d4dd05aea2a8a693c731e10fa917cd768995c06616a35df03b538c6c22092b49478bf4
SSDEEP

768:vwE9HvjImsukAuz4ltFsKOEAIREoHsDp0J:v/I5FAuzalb1REesl

Score

N/A

Malware Config

Signatures

Files

5d5f39f08e1e0fb32bcd64145ac69089faa076fa0fc48dfcf773f78af89f05dc
.exe windows x86

bd60b74c76914a5bb6ae4e83e8f9f543

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwQueryValueKey
RtlInitUnicodeString
swprintf
memset
ExAllocatePoolWithTag
ZwDeleteFile
ZwClose
ZwSetInformationFile
ZwQueryInformationFile
ZwCreateFile
PsGetVersion
KeLeaveCriticalRegion
KeEnterCriticalRegion
strncmp
strlen
IoGetCurrentProcess
ZwFlushKey
ZwSetValueKey
ZwOpenKey
wcslen
wcscmp
IoRegisterDriverReinitialization
memcpy
RtlCompareMemory
MmIsAddressValid
_except_handler3
strncpy
RtlUnicodeStringToAnsiString
wcsrchr
wcsncmp
wcsncat
wcscat
wcsncpy
ZwEnumerateKey
ZwQueryKey
wcscpy
PsSetLoadImageNotifyRoutine
IoRegisterShutdownNotification
IoCreateDevice
ZwQuerySystemInformation
IoCreateFile
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
KeGetCurrentThread
IoAllocateIrp
IoGetBaseFileSystemDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
IoDetachDevice
IoDeleteDevice
IoDeleteSymbolicLink
_stricmp
strrchr
ObReferenceObjectByName
IoDriverObjectType
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
InterlockedExchange
strcmp
RtlFreeAnsiString
strstr
_strlwr
ZwReadFile
KeServiceDescriptorTable
IofCompleteRequest
ExFreePool

hal

KeGetCurrentIrql

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd60b74c76914a5bb6ae4e83e8f9f543

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 41KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 768B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 41KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 768B

.reloc
Size: 2KB - Virtual size: 1KB