339202a9828179fa7fc2fce6ed74f21c26f8cd8a579077a75b5edddc53af70bd

General

Target

339202a9828179fa7fc2fce6ed74f21c26f8cd8a579077a75b5edddc53af70bd
Size

15KB
MD5

3dc0fdda1e355486c376e96d05223e6c
SHA1

1318941f4908eee538e24dfa5060ed3261f0f9de
SHA256

339202a9828179fa7fc2fce6ed74f21c26f8cd8a579077a75b5edddc53af70bd
SHA512

9b067df264d4baf5ca3fa7f1f966b7d11e48431fc3e90535883f6bb723371975cc336870a88b2c8a6f29ba893b11209750f6567e63b1412a4cc751666a3bb5ac
SSDEEP

384:3+Qbw0OwufUvEo2+KX8owLTBUu1ItktDHrrO/:3+Qk9Uvi+KMvfBUF

Score

N/A

Malware Config

Signatures

Files

339202a9828179fa7fc2fce6ed74f21c26f8cd8a579077a75b5edddc53af70bd
.exe windows x86

564a6db9cac033f86527668869135ddb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
_strupr
strrchr
PsSetLoadImageNotifyRoutine
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 352B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 358B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

564a6db9cac033f86527668869135ddb

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 352B - Virtual size: 336B

.data Size: 9KB - Virtual size: 9KB

INIT Size: 960B - Virtual size: 946B

.reloc Size: 384B - Virtual size: 358B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 352B - Virtual size: 336B

.data
Size: 9KB - Virtual size: 9KB

INIT
Size: 960B - Virtual size: 946B

.reloc
Size: 384B - Virtual size: 358B