b66866717ff5a34e010ecb43d5c88c377f1e2b9bafa6a5d51ae21e88ad6063f2

General

Target

b66866717ff5a34e010ecb43d5c88c377f1e2b9bafa6a5d51ae21e88ad6063f2
Size

16KB
MD5

6aae4cbaecd0f53cd6cbd052068d66ce
SHA1

503163e431670237633926bea68d898fd84cc8c2
SHA256

b66866717ff5a34e010ecb43d5c88c377f1e2b9bafa6a5d51ae21e88ad6063f2
SHA512

b82524f3a935ce782d475058d3427921adf710218eea03cb1b1e72f41bb9dfd89f9b24e71d6e8f6253fe7f970b0ef92eb5837fb18ca1673774eae812ddcc6711
SSDEEP

192:xy+9spjVQ3rp0XtUtuyNp2+KO2XX8owLTBUbQoFW:o+hV6tQt2+KX8owLTBUV

Score

N/A

Malware Config

Signatures

Files

b66866717ff5a34e010ecb43d5c88c377f1e2b9bafa6a5d51ae21e88ad6063f2
.exe windows x86

d42e39cdbeae470dcd6e96a23ecfc3f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_strlwr
RtlUnicodeStringToAnsiString
ZwQuerySystemInformation
_stricmp
_strupr
strrchr
ZwPulseEvent
MmGetSystemRoutineAddress
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 370B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d42e39cdbeae470dcd6e96a23ecfc3f7

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 288B - Virtual size: 280B

.data Size: 10KB - Virtual size: 10KB

INIT Size: 960B - Virtual size: 946B

.reloc Size: 384B - Virtual size: 370B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 288B - Virtual size: 280B

.data
Size: 10KB - Virtual size: 10KB

INIT
Size: 960B - Virtual size: 946B

.reloc
Size: 384B - Virtual size: 370B