53f5dbac327cd20557e0b04987df0ab55c79b42e9c34ecc9a60c4b0cda74c1ea

General

Target

53f5dbac327cd20557e0b04987df0ab55c79b42e9c34ecc9a60c4b0cda74c1ea
Size

40KB
MD5

9b42717ca99d980b790d911dfc2e9a74
SHA1

4c878c6569e8b9b22123ac601d616de0aa983b8b
SHA256

53f5dbac327cd20557e0b04987df0ab55c79b42e9c34ecc9a60c4b0cda74c1ea
SHA512

a537d9328c10bce30db860ee91fbdd62dbf7de74f80654bb0299702ec1ec6416da1f52acd52f7b241fe96d8c29637d362ee09dc544f6ca38b1a9ab5e0cbca92d
SSDEEP

768:C/XBFfcctgOWVBC4ELtMNuzIlufo0Kn/aQzL:eBFHgk4EL9Mcfob7zL

Score

N/A

Malware Config

Signatures

Files

53f5dbac327cd20557e0b04987df0ab55c79b42e9c34ecc9a60c4b0cda74c1ea
.exe windows x86

7ab0c96f7f363328660d56a64c584883

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcsncmp
wcslen
ExFreePool
ZwEnumerateKey
ExAllocatePoolWithTag
sprintf
_strupr
wcscpy
wcscmp
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
ZwDeviceIoControlFile
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_wcsupr
ZwClose
ZwSetValueKey
swprintf
ObfDereferenceObject
RtlInitAnsiString
ObReferenceObjectByHandle
strchr
ObQueryNameString

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 768B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ab0c96f7f363328660d56a64c584883

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 10KB - Virtual size: 10KB

.data Size: 3KB - Virtual size: 3KB

INIT Size: 1024B - Virtual size: 946B

.rsrc Size: 128B - Virtual size: 16B

.reloc Size: 768B - Virtual size: 744B

.vmp0 Size: 22KB - Virtual size: 22KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 3KB

INIT
Size: 1024B - Virtual size: 946B

.rsrc
Size: 128B - Virtual size: 16B

.reloc
Size: 768B - Virtual size: 744B

.vmp0
Size: 22KB - Virtual size: 22KB

.reloc
Size: 1KB - Virtual size: 1KB