fbb49e370805172db2ab92483e4b5fa623df0caf97ea96e2b8c8b54bfe2ebdd1

General

Target

fbb49e370805172db2ab92483e4b5fa623df0caf97ea96e2b8c8b54bfe2ebdd1
Size

15KB
MD5

05805afee555f83699613248458f6b6f
SHA1

b026074847a442951d62a7851bbf49b303a2eb20
SHA256

fbb49e370805172db2ab92483e4b5fa623df0caf97ea96e2b8c8b54bfe2ebdd1
SHA512

0271818a6f56de3910804f018de5b95a3bce5092c9b428854e8af55e104e7b1de3efdc9cb106e36c1ec0de4d8ea9f5e29700a229b38a0f682b43113778da652c
SSDEEP

192:wB7r3+tur0nRvMoeyPkUtSvQV12fNFtAxUuQe2IQ4kLntlq3Kd:wB7j6sGvnVYf1KQlq3Kd

Score

N/A

Malware Config

Signatures

Files

fbb49e370805172db2ab92483e4b5fa623df0caf97ea96e2b8c8b54bfe2ebdd1
.exe windows x86

e8704d6182f9efa68cc6e906e6443473

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnlockPages
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
_stricmp
strrchr
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObfDereferenceObject
IoDriverObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeSetEvent
ZwReadFile
ZwQueryInformationFile
KeWaitForSingleObject
KeGetCurrentThread
MmProbeAndLockPages
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
IoGetCurrentProcess
ObReferenceObjectByHandle
IoFileObjectType
_allmul
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
ZwClose
IoFreeIrp

hal

KeStallExecutionProcessor

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896B - Virtual size: 813B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mcata
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8704d6182f9efa68cc6e906e6443473

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 896B - Virtual size: 813B

.data Size: 4KB - Virtual size: 4KB

mcata Size: 640B - Virtual size: 520B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 520B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 896B - Virtual size: 813B

.data
Size: 4KB - Virtual size: 4KB

mcata
Size: 640B - Virtual size: 520B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 520B