b94377b6ed1eba59e1fa4a6278111b4fbb2556a043fe999f3dac03f8f4072aec

General

Target

b94377b6ed1eba59e1fa4a6278111b4fbb2556a043fe999f3dac03f8f4072aec
Size

12KB
MD5

556d9fa774d1d6555b55df17445a1113
SHA1

b1c83fbc5b85943467c3ffcbf4e47448eedf67e8
SHA256

b94377b6ed1eba59e1fa4a6278111b4fbb2556a043fe999f3dac03f8f4072aec
SHA512

b23528f4ef5afb3fc8b53f7c1533803f4a526fa203ec951ea13215da2316528f4b098ffdf3543136a13cac0905cc044b8301746eb830601a6588bc8928679658
SSDEEP

384:cICNsVeCZuZBOx1+TntNxZBHnUB3yjbj:cIbxct1hgcX

Score

N/A

Malware Config

Signatures

Files

b94377b6ed1eba59e1fa4a6278111b4fbb2556a043fe999f3dac03f8f4072aec
.exe windows x86

3ea7c10b5e4570d9e3446dfe57bba293

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwQuerySystemInformation
ExAllocatePoolWithTag
strstr
ObfDereferenceObject
wcslen
ObQueryNameString
ObReferenceObjectByHandle
KeReleaseMutex
KeWaitForSingleObject
wcsncpy
IoGetCurrentProcess
KeServiceDescriptorTable
PsLookupProcessByProcessId
wcsncat
wcscat
wcscpy
ZwClose
ZwDeleteValueKey
ExFreePoolWithTag
ZwEnumerateValueKey
ZwEnumerateKey
ZwOpenKey
ZwQueryDirectoryFile
ZwOpenThread
ZwOpenProcess
IofCompleteRequest
NtBuildNumber
KeInitializeMutex
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
swprintf
wcsncmp
ObOpenObjectByName
wcsstr
_except_handler3
RtlImageDirectoryEntryToData
ZwSetValueKey
ProbeForRead

hal

KfLowerIrql
KfRaiseIrql

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 446B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ea7c10b5e4570d9e3446dfe57bba293

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 512B - Virtual size: 412B

.data Size: 128B - Virtual size: 112B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 446B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 512B - Virtual size: 412B

.data
Size: 128B - Virtual size: 112B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 446B