10664e60d3514e93a9bea9ceb4fbf915612ae06beda2a7bc7ec2b7e285dedc8a

Sharing

Copy URL Twitter E-mail

General

Target

10664e60d3514e93a9bea9ceb4fbf915612ae06beda2a7bc7ec2b7e285dedc8a
Size

40KB
MD5

5c6948961562c6971f2815170a989253
SHA1

7d27c8b55be5ac5fc41ef96eb7c4b1f2192cb625
SHA256

10664e60d3514e93a9bea9ceb4fbf915612ae06beda2a7bc7ec2b7e285dedc8a
SHA512

665a19bde6051b28fd6eb7515b89ab3f5e78fc747410af87120f949ba1abc6acb42a96a1da7746a2290afe4e20d7a26d95b36db5252d065e267d74f6a4f1332f
SSDEEP

768:1CoPMhxmC/YXmcNItnH9I806EQIAmTffaCXLnOm0dNSarhdho6IjOthHDEg1BXAQ:1VYLRaynH9I8zIAmbvX7Lwh9IjOPDrBj

Score

N/A

Malware Config

Signatures

Files

10664e60d3514e93a9bea9ceb4fbf915612ae06beda2a7bc7ec2b7e285dedc8a
.exe windows x86

6c257d73323fbcaac4c5fa894b788e6a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_wcsnicmp
wcslen
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwCreateFile
swprintf
ZwOpenKey
ZwDeleteKey
ZwSetValueKey
wcscat
wcscpy
ObfDereferenceObject
MmIsAddressValid
IoDeviceObjectType
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snwprintf
wcsncpy
wcschr
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
_stricmp
ExFreePool
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
ObReferenceObjectByHandle
wcsstr
_wcslwr
KeQuerySystemTime
_snprintf
PsGetVersion
IoRegisterDriverReinitialization
_wcsicmp
strncpy
IoGetCurrentProcess
KeDelayExecutionThread
ZwSetInformationFile
RtlCompareUnicodeString
MmGetSystemRoutineAddress
PsCreateSystemThread
wcsrchr
IofCompleteRequest
PsLookupProcessByProcessId
_except_handler3
ZwCreateKey
strncmp

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEWMI
Size: 32B - Virtual size: 10B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDRV
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESYS
Size: 32B - Virtual size: 3B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 64B - Virtual size: 59B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c257d73323fbcaac4c5fa894b788e6a

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 7KB

PAGEWMI Size: 32B - Virtual size: 10B

PAGEDRV Size: 32B - Virtual size: 8B

PAGESYS Size: 32B - Virtual size: 3B

PAGE Size: 64B - Virtual size: 59B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 7KB

PAGEWMI
Size: 32B - Virtual size: 10B

PAGEDRV
Size: 32B - Virtual size: 8B

PAGESYS
Size: 32B - Virtual size: 3B

PAGE
Size: 64B - Virtual size: 59B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB