3a81fc742017e6a1811fb9cbfe4d284168b1c734dc8b6f202cd858ab3503348a

General

Target

3a81fc742017e6a1811fb9cbfe4d284168b1c734dc8b6f202cd858ab3503348a
Size

186KB
MD5

41e1051f2c7e75eec0423ee14e4dd158
SHA1

38552327b09e53560bef111ebe8878393cd96bce
SHA256

3a81fc742017e6a1811fb9cbfe4d284168b1c734dc8b6f202cd858ab3503348a
SHA512

32a54cae64ead45c022e1f796bbe959a5709d5d324eb8f6e657252e76268215291bd7c6031df12decae69d4adf4cdc11d89cdfbf27f8acd68be65c7461586cce
SSDEEP

3072:miMqqDL2/xV8RMaNvY3eDcoqr8rrEPnNi5NWNgdP/LeeK99Z7T7du/OxUvyCI9fY:aqqDL6UxlyeDcoqrApx/I9P7auUvyCId

Score

N/A

Malware Config

Signatures

Files

3a81fc742017e6a1811fb9cbfe4d284168b1c734dc8b6f202cd858ab3503348a
.exe windows x64

f9301e2efa6fd14628e56db344340066

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

__chkstk
IoRegisterShutdownNotification
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeWaitForSingleObject
KeReleaseMutex
ObfDereferenceObject
KeReleaseSemaphore
ExFreePoolWithTag
ExAllocatePoolWithTag
wcsncat
IoDeleteSymbolicLink
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
ZwClose
ObReferenceObjectByHandle
ZwCreateFile
IoGetRelatedDeviceObject
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeInitializeSemaphore
ExInterlockedRemoveHeadList
PsTerminateSystemThread
KeSetEvent
wcsncpy
KeSetPriorityThread
ExInterlockedInsertTailList
IoSetHardErrorOrVerifyDevice
IofCompleteRequest
PsCreateSystemThread
ObOpenObjectByPointer
IoGetCurrentProcess
KeInitializeMutex
IoFreeIrp
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
KeBugCheck
KeClearEvent
ZwSetInformationFile
ZwQueryInformationFile
_snwprintf
wcsstr
ZwReadFile
IoFileObjectType
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
KeBugCheckEx

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 416B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9301e2efa6fd14628e56db344340066

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 147KB - Virtual size: 147KB

.data Size: 32KB - Virtual size: 32KB

.pdata Size: 1KB - Virtual size: 1KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 896B - Virtual size: 872B

.reloc Size: 416B - Virtual size: 396B

.text
Size: 147KB - Virtual size: 147KB

.data
Size: 32KB - Virtual size: 32KB

.pdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 896B - Virtual size: 872B

.reloc
Size: 416B - Virtual size: 396B