bb5b7d77d7bb5c8d7ff618120046e89b7d9dc00e5a31a0a1d4dc7d1cd43bcc63

Sharing

Copy URL Twitter E-mail

General

Target

bb5b7d77d7bb5c8d7ff618120046e89b7d9dc00e5a31a0a1d4dc7d1cd43bcc63
Size

22KB
MD5

90b54a7aec0acb3d4b04cef7fe6678c0
SHA1

1f5b633dc0433c745710d849ae9661cecdb6dc21
SHA256

bb5b7d77d7bb5c8d7ff618120046e89b7d9dc00e5a31a0a1d4dc7d1cd43bcc63
SHA512

ba45127993d341b1737a01995022e32ab411a1b9741468643156a583781739d347b4dbc779ae2e7b18074f18677ccbe35dd9f473eb1be7661e0bf27f0ff20ea2
SSDEEP

384:X+uNxw/uBZ8R9v3EyuvymG6EQUgyedl/FyhgCInGWqmOcFdA9EG2tkVgHiZaBjQk:X+wxw/IeLCG9

Score

N/A

Malware Config

Signatures

Files

bb5b7d77d7bb5c8d7ff618120046e89b7d9dc00e5a31a0a1d4dc7d1cd43bcc63
.exe windows x86

56d7b802320bf0e1abb78776fb3907eb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ZwClose
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
_strlwr
_strupr
strrchr
_stricmp
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
RtlFreeUnicodeString
_except_handler3

hal

KeGetCurrentIrql

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 832B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

g7ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

g6ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

g5ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

g4ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

g3ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

g2ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

g1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 832B - Virtual size: 804B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56d7b802320bf0e1abb78776fb3907eb

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 832B - Virtual size: 832B

.data Size: 10KB - Virtual size: 10KB

g7ata Size: 512B - Virtual size: 512B

g6ata Size: 512B - Virtual size: 512B

g5ata Size: 512B - Virtual size: 512B

g4ata Size: 512B - Virtual size: 512B

g3ata Size: 512B - Virtual size: 512B

g2ata Size: 512B - Virtual size: 512B

g1ata Size: 512B - Virtual size: 512B

INIT Size: 832B - Virtual size: 804B

.reloc Size: 608B - Virtual size: 600B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 832B - Virtual size: 832B

.data
Size: 10KB - Virtual size: 10KB

g7ata
Size: 512B - Virtual size: 512B

g6ata
Size: 512B - Virtual size: 512B

g5ata
Size: 512B - Virtual size: 512B

g4ata
Size: 512B - Virtual size: 512B

g3ata
Size: 512B - Virtual size: 512B

g2ata
Size: 512B - Virtual size: 512B

g1ata
Size: 512B - Virtual size: 512B

INIT
Size: 832B - Virtual size: 804B

.reloc
Size: 608B - Virtual size: 600B