91f22edda70a09d21fd3971c01e880198e51b86726d405102f5a0e5f5d80d2b4

General

Target

91f22edda70a09d21fd3971c01e880198e51b86726d405102f5a0e5f5d80d2b4
Size

445KB
MD5

cf8f78e92c67bf9f33ee445961d43721
SHA1

9c5ae03d4c149f23a3f1307243ac6dfc671d1400
SHA256

91f22edda70a09d21fd3971c01e880198e51b86726d405102f5a0e5f5d80d2b4
SHA512

d611a68f67ef32c5147cf7a2afecbaa3f236b5d6547d95eb3e048b7785567bccc5494019a32172d58a0a501979462ccc3a0c0b6a1d6bf33ff288431dad95562f
SSDEEP

6144:Epycnlsz+8EhsOt8gbCCeglCeskyLwIcJ5puCOuF+53IykoNCDbRuNLdkzaE4:Ejsz+8GcglC3kwwIcJCCrdo8o5

Score

N/A

Malware Config

Signatures

Files

91f22edda70a09d21fd3971c01e880198e51b86726d405102f5a0e5f5d80d2b4
.dll windows x86

9d6940455a5432728e1f04859d009351

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ObfDereferenceObject
ExAllocatePool
ExFreePoolWithTag
ZwClose
ZwSetSystemInformation
swprintf
RtlInitUnicodeString
IoCreateDriver
ObMakeTemporaryObject
ExUuidCreate
RtlStringFromGUID
sprintf
RtlFreeUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwCreateFile
ZwQueryInformationFile
KeQuerySystemTime
RtlTimeToTimeFields
ZwDeleteFile
ZwOpenFile
ZwReadFile
RtlIpv4StringToAddressExA
KeInsertQueue
KeRemoveQueue
KeRundownQueue
IoFreeIrp
KeInitializeQueue
ObfReferenceObject
PsCreateSystemThread
ObReferenceObjectByHandle
IoBuildDeviceIoControlRequest
IofCallDriver
ZwOpenSection
ZwMapViewOfSection
MmAllocatePagesForMdl
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmFreePagesFromMdl
ZwUnmapViewOfSection
RtlHashUnicodeString
ExAllocatePoolWithTag
PoStartNextPowerIrp
IofCompleteRequest
PoCallDriver
ObReferenceObjectByName
IoDriverObjectType
IoEnumerateDeviceObjectList
IoCreateDevice
ZwCreateSection
ZwFlushVirtualMemory
ZwOpenKey
ZwEnumerateKey
ZwDeleteKey
ZwQueryKey
IoQueueWorkItem
ZwLoadDriver
ZwQueryDirectoryFile
IoGetRelatedDeviceObject
IoDeleteDevice
RtlPrefixUnicodeString
wcsrchr
IoAllocateWorkItem
KeInitializeTimer
KeInitializeDpc
KeSetTimerEx
_allmul
_allshr
_aullrem
memset
memcpy

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 449B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d6940455a5432728e1f04859d009351

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 449B

.reloc Size: 1024B - Virtual size: 962B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 449B

.reloc
Size: 1024B - Virtual size: 962B