cd7bf67b54bacb46724e9fd84f6c684e1be5fed67cc5a2b3b4bbb6bad66acf50

Sharing

Copy URL Twitter E-mail

General

Target

cd7bf67b54bacb46724e9fd84f6c684e1be5fed67cc5a2b3b4bbb6bad66acf50
Size

40KB
MD5

fb64464a051e3f1e18a4286056ecdd4c
SHA1

81a5630c07636c0c52c577f1397ed18b3ae34427
SHA256

cd7bf67b54bacb46724e9fd84f6c684e1be5fed67cc5a2b3b4bbb6bad66acf50
SHA512

dd8b2a3c7560ab142ded146c238f760282c1c219ae64a6d875f79d2fc170e23bd8c1163689c90f2b0c7ada96157448db14e95e5f8c2d1a6bcdb6377013eea2e1
SSDEEP

768:MPVjv30QhL4sMrPXBitw3DJmoWEE7yEycQ986GmPdwbYSBH:mTlhL4HdiiFmoxExQSbYSB

Score

N/A

Malware Config

Signatures

Files

cd7bf67b54bacb46724e9fd84f6c684e1be5fed67cc5a2b3b4bbb6bad66acf50
.exe windows x86

2cf78e86397a80f71f14a6efbdc6619e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwDeleteKey
swprintf
ZwOpenKey
RtlInitUnicodeString
ZwSetValueKey
ObfDereferenceObject
wcslen
strncmp
IoRegisterDriverReinitialization
KeDelayExecutionThread
KeQuerySystemTime
ZwCreateFile
strncpy
PsLookupProcessByProcessId
_stricmp
MmIsAddressValid
RtlAnsiStringToUnicodeString
ObReferenceObjectByHandle
wcscat
wcscpy
_wcsicmp
ZwQueryValueKey
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
wcsncpy
wcsrchr
KeTickCount
KeQueryTimeIncrement
IoGetCurrentProcess
wcsstr
_wcslwr
RtlCopyUnicodeString
IofCompleteRequest
ZwSetInformationFile
RtlCompareUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
_snwprintf
wcschr
_wcsnicmp
PsGetVersion
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
ZwCreateKey

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEWMI
Size: 32B - Virtual size: 10B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDRV
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESYS
Size: 32B - Virtual size: 3B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 96B - Virtual size: 84B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cf78e86397a80f71f14a6efbdc6619e

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 7KB

PAGEWMI Size: 32B - Virtual size: 10B

PAGEDRV Size: 32B - Virtual size: 8B

PAGESYS Size: 32B - Virtual size: 3B

PAGE Size: 96B - Virtual size: 84B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 7KB

PAGEWMI
Size: 32B - Virtual size: 10B

PAGEDRV
Size: 32B - Virtual size: 8B

PAGESYS
Size: 32B - Virtual size: 3B

PAGE
Size: 96B - Virtual size: 84B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB