94f1a56f8eea647d98d0dc583e9b747e7994fe5f07523d341ee71faf1dd002a7

Sharing

Copy URL

Twitter E-mail

General

Target

94f1a56f8eea647d98d0dc583e9b747e7994fe5f07523d341ee71faf1dd002a7
Size

25KB
MD5

f2a7c2e52f59b72bd6bd5c056b737282
SHA1

bb85632ce0216ab957b2728a19dc07f681e5cb7f
SHA256

94f1a56f8eea647d98d0dc583e9b747e7994fe5f07523d341ee71faf1dd002a7
SHA512

d08f8be1f9ae74acee2bcd64f76f5e9c971373a244a081f18833e456549d9be227dc2b0d33feeee8b2259b1c0c08209be80b50fa94162e4441bca5e3f0e17fcc
SSDEEP

768:k7qpWJ/sTqLnsv/iUgm5uLjr/EP6cLFsPca4Z:k4v/LvSsLFDZ

Score

N/A

Malware Config

Signatures

Files

94f1a56f8eea647d98d0dc583e9b747e7994fe5f07523d341ee71faf1dd002a7
.exe windows x64

951da96022a69121016dd645ec3a6d0b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlAnsiStringToUnicodeString
KeSetEvent
KeInitializeDpc
RtlInitString
KeReleaseSpinLock
IoAllocateErrorLogEntry
KeInitializeTimer
RtlxAnsiStringToUnicodeSize
KeQueryTimeIncrement
KeWaitForSingleObject
KeSetTimer
KeAcquireSpinLockRaiseToDpc
MmUnmapLockedPages
IoBuildPartialMdl
IoIs32bitProcess
KeReleaseSpinLockFromDpcLevel
MmFreeMappingAddress
MmMapLockedPagesWithReservedMapping
IoWriteErrorLogEntry
MmAllocateMappingAddress
NtCreateFile
MmUnmapReservedMapping
KeAcquireSpinLockAtDpcLevel
_wcsicmp
ExFreePoolWithTag
_wcsnicmp
RtlInitUnicodeString
RtlAppendUnicodeToString
KeInitializeEvent
ZwQueryValueKey
ZwClose
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
RtlCopyUnicodeString
DbgPrint
ZwOpenKey
KeBugCheckEx
ExAllocatePoolWithTag
NlsMbCodePageTag
MmMapLockedPagesSpecifyCache
ExQueueWorkItem
__C_specific_handler

ndis.sys

NdisReturnPackets
NdisDeregisterTdiCallBack
�� rRdgisudsUeiCallC`cj

Exports

Exports

CTEAllocateString
CTEBlock
CTEBlockWithTracker
CTEInitEvent
CTEInitString
CTEInitTimer
CTEInitialize
CTEInsertBlockTracker
CTELogEvent
CTERemoveBlockTracker
CTEScheduleCriticalEvent
CTEScheduleDelayedEvent
CTEScheduleEvent
CTESignal
CTEStartTimer
CTESystemUpTime
DllInitialize
DllUnload
TdiBuildNetbiosAddress
TdiBuildNetbiosAddressEa
TdiCopyBufferToMdl
TdiCopyBufferToMdlWithReservedMappingAtDpcLevel
TdiCopyMdlChainToMdlChain
TdiCopyMdlToBuffer
TdiDefaultChainedRcvDatagramHandler
TdiDefaultChainedRcvExpeditedHandler
TdiDefaultChainedReceiveHandler
TdiDefaultConnectHandler
TdiDefaultDisconnectHandler
TdiDefaultErrorHandler
TdiDefaultRcvDatagramHandler
TdiDefaultRcvExpeditedHandler
TdiDefaultReceiveHandler
TdiDefaultSendPossibleHandler
TdiDeregisterAddressChangeHandler
TdiDeregisterDeviceObject
TdiDeregisterNetAddress
TdiDeregisterNotificationHandler
TdiDeregisterPnPHandlers
TdiDeregisterProvider
TdiEnumerateAddresses
TdiInitialize
TdiMapUserRequest
TdiMatchPdoWithChainedReceiveContext
TdiOpenNetbiosAddress
TdiPnPPowerComplete
TdiPnPPowerRequest
TdiProvider�C�oy
TdiRegisterAddressChangeHandler
TdiRegisterDeviceObject
TdiRegisterNetAddress
TdiRegisterNotificationHandler
TdiRegisterPnPHandlers
TdiRegisterProvider
TdiReturnChainedReceives

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 349B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

951da96022a69121016dd645ec3a6d0b

Headers

File Characteristics

Imports

ntoskrnl.exe

ndis.sys

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 996B

PAGE Size: 512B - Virtual size: 349B

.edata Size: 2KB - Virtual size: 1KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 512B - Virtual size: 8B

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 996B

PAGE
Size: 512B - Virtual size: 349B

.edata
Size: 2KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 512B - Virtual size: 8B