9655aea1496f5485f538ed3b2b7bbbfeb925e98dad4ae1933d31aa522562a76e

General

Target

9655aea1496f5485f538ed3b2b7bbbfeb925e98dad4ae1933d31aa522562a76e
Size

34KB
MD5

c9fe74479c19fd1ac33472ce27bbba44
SHA1

0cbfeaa13b83dd7053031501683618a26c364647
SHA256

9655aea1496f5485f538ed3b2b7bbbfeb925e98dad4ae1933d31aa522562a76e
SHA512

c6321273360f2ceee269c11f0d7e4c28351e59a5a0c152a69640d0b50fd3f12954b7e83df3d39d3ed6bda245782ba345988b2b6961e7f454fefd41bf42017184
SSDEEP

768:oW/ZgNLHIPU41YoMnl6G5KZjJNxptqO3ex43nCTowmqC:oW91PM98jXxrqO3k4nfw

Score

N/A

Malware Config

Signatures

Files

9655aea1496f5485f538ed3b2b7bbbfeb925e98dad4ae1933d31aa522562a76e
.exe windows x86

086c9c4eb3fec2134fab95771b37a091

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwSetInformationFile
wcscpy
wcslen
ZwOpenFile
RtlInitUnicodeString
PsLookupProcessByProcessId
NtBuildNumber
IofCompleteRequest
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
_except_handler3
ZwWriteFile
ZwCreateFile
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwSetValueKey
wcscat
wcsncpy
ZwOpenKey
ZwCreateKey
IoCreateSymbolicLink
IoRegisterShutdownNotification
IoCreateDevice
wcsncat
MmIsAddressValid
ObReferenceObjectByName
IoDriverObjectType
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
ProbeForRead
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
ZwDeleteValueKey
ZwEnumerateValueKey
ZwEnumerateKey
KeServiceDescriptorTable
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
KeTickCount
KeBugCheckEx

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 149B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

086c9c4eb3fec2134fab95771b37a091

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 512B - Virtual size: 388B

.data Size: 256B - Virtual size: 149B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 896B - Virtual size: 812B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 512B - Virtual size: 388B

.data
Size: 256B - Virtual size: 149B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 896B - Virtual size: 812B