ed19665494858ca5e6a17e15098d1f3e9c430c1f2d5836d7aa466c75c3fda9aa

Sharing

Copy URL Twitter E-mail

General

Target

ed19665494858ca5e6a17e15098d1f3e9c430c1f2d5836d7aa466c75c3fda9aa
Size

80KB
MD5

7254fc2474bb0420fd40c6ced3c3c9a7
SHA1

bf9036c23fbcc06eb3b94a4bcfe00ee31ee8bbc0
SHA256

ed19665494858ca5e6a17e15098d1f3e9c430c1f2d5836d7aa466c75c3fda9aa
SHA512

7ffb016367448c9c050ad0b939ef7a248b54443bef08d5801738c1d2380f1047b094cd0c61f9193a2c2fe46cc10e4a083bd7da8694f3e9e3de4397ed9534ea58
SSDEEP

1536:dWuVQTus5s1iod/XifZzCsGaGZG3l14/TuwG:dvQCmokfsspK/To

Score

N/A

Malware Config

Signatures

Files

ed19665494858ca5e6a17e15098d1f3e9c430c1f2d5836d7aa466c75c3fda9aa
.exe windows x86

f09bbd217cab2208c5a8371830d83a72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ZwClose
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQueryValueKey
IoOpenDeviceRegistryKey
IoGetDeviceProperty
KeInitializeSpinLock
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
PoSetPowerState
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
IoDeleteDevice
IofCallDriver
InterlockedExchange
KeInitializeEvent
KeClearEvent
KeResetEvent
KeWaitForSingleObject
KeWaitForMultipleObjects
IoAllocateIrp
IoInitializeIrp
IoFreeIrp
IoCancelIrp
IoStartPacket
IoIsWdmVersionAvailable
KeInsertQueueDpc
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
InterlockedIncrement
InterlockedDecrement
wcscpy
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
wcslen
MmMapIoSpace
MmUnmapIoSpace
PoRegisterDeviceForIdleDetection
PoRequestPowerIrp
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
IoCreateDevice
IoAttachDeviceToDeviceStack
IoDetachDevice
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
ObfReferenceObject
ObfDereferenceObject
IoGetAttachedDeviceReference
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoInvalidateDeviceRelations
IoGetDeviceObjectPointer
vsprintf
RtlCopyUnicodeString
RtlInitUnicodeString
KeInitializeDeviceQueue
KeInsertDeviceQueue
KeInsertByKeyDeviceQueue
KeRemoveDeviceQueue
KeRemoveByKeyDeviceQueue
KeRemoveEntryDeviceQueue
ExFreePool
IoStartNextPacket
KeInitializeTimerEx
KeCancelTimer
KeSetTimerEx
ExAllocatePoolWithTag
RtlUnwind

hal

ExAcquireFastMutex
KeGetCurrentIrql
KfLowerIrql
KfRaiseIrql
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock

smclib.sys

SmartcardDeviceControl
SmartcardExit
SmartcardT0Reply
SmartcardT0Request
SmartcardT1Reply
SmartcardT1Request
SmartcardUpdateCardCapabilities
SmartcardInitialize
SmartcardCreateLink

usbd.sys

USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx

Exports

Exports

?isWin98@@YGEXZ

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

page
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

init
Size: 896B - Virtual size: 774B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 896B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 128B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f09bbd217cab2208c5a8371830d83a72

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

smclib.sys

usbd.sys

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

page Size: 53KB - Virtual size: 53KB

init Size: 896B - Virtual size: 774B

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 896B - Virtual size: 820B

.edata Size: 128B - Virtual size: 78B

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 9KB - Virtual size: 9KB

page
Size: 53KB - Virtual size: 53KB

init
Size: 896B - Virtual size: 774B

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 896B - Virtual size: 820B

.edata
Size: 128B - Virtual size: 78B

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB