cf5b0f4f3597376f0966e8c1c18afa7c305e05e924291472ffa20a3ddc6b7da9

General

Target

cf5b0f4f3597376f0966e8c1c18afa7c305e05e924291472ffa20a3ddc6b7da9
Size

17KB
MD5

4fad9e4d578fae4d2cfaa11a319701c9
SHA1

700f260c3e5bcb27f2e4d46013bc3346ae03e8e6
SHA256

cf5b0f4f3597376f0966e8c1c18afa7c305e05e924291472ffa20a3ddc6b7da9
SHA512

0d7feb7827886647608f4695da30136b41715baf992c2b8951781d1e31f4ebc0d3d4d1e4a2e875988bedecc19015e38fcc126c44237d87640db8cd09cb04dc82
SSDEEP

192:JCTA+9sp3uQxEn3bcQQujtiQd2+KO2XX8owLTBUW6wwFaWb:JP+uxA3bcQQ8tiQd2+KX8owLTBUUwBb

Score

N/A

Malware Config

Signatures

Files

cf5b0f4f3597376f0966e8c1c18afa7c305e05e924291472ffa20a3ddc6b7da9
.exe windows x86

d42e39cdbeae470dcd6e96a23ecfc3f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_strlwr
RtlUnicodeStringToAnsiString
ZwQuerySystemInformation
_stricmp
_strupr
strrchr
ZwPulseEvent
MmGetSystemRoutineAddress
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 370B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d42e39cdbeae470dcd6e96a23ecfc3f7

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 288B - Virtual size: 264B

.data Size: 11KB - Virtual size: 11KB

INIT Size: 960B - Virtual size: 946B

.reloc Size: 384B - Virtual size: 370B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 288B - Virtual size: 264B

.data
Size: 11KB - Virtual size: 11KB

INIT
Size: 960B - Virtual size: 946B

.reloc
Size: 384B - Virtual size: 370B