e569a4b4aa02059b7c81045888c0d62ac9ddb72776296aae8dac104a68b32403

General

Target

e569a4b4aa02059b7c81045888c0d62ac9ddb72776296aae8dac104a68b32403
Size

15KB
MD5

39f02a9007c8327b4dc3d50f02325175
SHA1

12efccb2b12d095cf280288bf4445f0fe57e140f
SHA256

e569a4b4aa02059b7c81045888c0d62ac9ddb72776296aae8dac104a68b32403
SHA512

17f2904b05e8de86a43ed16e56715cffc6652cabfb76056acca904fe365e8deae43c5f58527c175f16e3d5bbc0368f645e33d76cde9c1517ccab86a42d625b26
SSDEEP

192:rScsSURuifhnRYy4ktSuhU9Q9sbJCsMddGdeO9BkJ+DGRPYCmJf1EAKUq8XWAQW6:rScqLdtxG6swdf4kJRPMbK58XWAQW6

Score

N/A

Malware Config

Signatures

Files

e569a4b4aa02059b7c81045888c0d62ac9ddb72776296aae8dac104a68b32403
.exe windows x86

80593df224fe5516b8e3ab5e61af2b50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
towlower
wcscat
wcscpy
wcsrchr
PsTerminateSystemThread
KeDelayExecutionThread
RtlWriteRegistryValue
RtlCreateRegistryKey
RtlQueryRegistryValues
ExFreePoolWithTag
ZwOpenKey
ZwEnumerateKey
ObfDereferenceObject
ZwWaitForSingleObject
ObOpenObjectByPointer
PsProcessType
_wcsnicmp
wcslen
ExAllocatePoolWithTag
RtlGetVersion
_strnicmp
IoGetCurrentProcess
ZwCreateFile
ZwReadFile
ZwQueryInformationFile
ZwWriteFile
ZwDeleteFile
DbgPrint
KeServiceDescriptorTable
_stricmp
RtlUnicodeStringToAnsiString

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 828B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 640B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80593df224fe5516b8e3ab5e61af2b50

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 256B - Virtual size: 140B

.data Size: 5KB - Virtual size: 5KB

INIT Size: 896B - Virtual size: 828B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 620B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 256B - Virtual size: 140B

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 896B - Virtual size: 828B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 620B