258cbe5132bc9801bd83b5236e0833204ddab9911a44187fc8414375e506db80

General

Target

258cbe5132bc9801bd83b5236e0833204ddab9911a44187fc8414375e506db80
Size

11KB
MD5

1da0817ceb2e11465248eac6ad6243cb
SHA1

5cfe15bcb883db2b4edf821a81a90eccffb90211
SHA256

258cbe5132bc9801bd83b5236e0833204ddab9911a44187fc8414375e506db80
SHA512

24a0eeebeff0e7215b0b7302a41fb582b70d541fe4da99da65bf410371344aa399c5fc0355557e24239396eca94a87c8d8611ce0f8ad7a68babdc4cabde20e3b
SSDEEP

192:bL0TlaOCyAhfWzWU2BAPAtG0iTyZ4PTfP5mfZvTtwdbc:boAtyARWB2qPAtGnpPTfP5EZZwdY

Score

N/A

Malware Config

Signatures

Files

258cbe5132bc9801bd83b5236e0833204ddab9911a44187fc8414375e506db80
.exe windows x86

3f404ec53da553113f111f0d4a2ddb23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memcpy
PsLookupProcessByProcessId
ExFreePoolWithTag
KeInsertQueueApc
KeInitializeApc
ExAllocatePool
ZwClose
ObfDereferenceObject
IoAttachDeviceToDeviceStack
RtlEqualUnicodeString
IoCreateDevice
IoGetBaseFileSystemDeviceObject
ObReferenceObjectByHandle
IoCreateFile
KeServiceDescriptorTable
_stricmp
_wcsicmp
FsRtlIsNameInExpression
IoDeleteDevice
IoDetachDevice
ZwQueryInformationProcess
ZwOpenProcess
PsGetVersion
KeDelayExecutionThread
KeGetCurrentThread
ZwAllocateVirtualMemory
PsGetCurrentProcessId
IoGetCurrentProcess
_snwprintf
MmMapLockedPagesSpecifyCache
memset
IofCallDriver
IofCompleteRequest
PoStartNextPowerIrp
ZwEnumerateKey
RtlInitUnicodeString
RtlFillMemoryUlong
KeUnstackDetachProcess
KeStackAttachProcess
ZwQueryObject
PsLookupThreadByThreadId
ZwLoadDriver
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
ObMakeTemporaryObject
ObfReferenceObject
ZwQuerySystemInformation
RtlImageDirectoryEntryToData
RtlImageNtHeader

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 298B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 768B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f404ec53da553113f111f0d4a2ddb23

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 384B - Virtual size: 298B

.data Size: 256B - Virtual size: 224B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 768B - Virtual size: 728B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 384B - Virtual size: 298B

.data
Size: 256B - Virtual size: 224B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 768B - Virtual size: 728B