d03243891b8541db53a73e88eadcc0e06fd4c4f19ae85f5e5bb946fa6c961b02

Sharing

Copy URL Twitter E-mail

General

Target

d03243891b8541db53a73e88eadcc0e06fd4c4f19ae85f5e5bb946fa6c961b02
Size

70KB
MD5

89c691aec50379aa9517ae8259252d2d
SHA1

a553da6db51c9253a265f051bf91fb8d1d73de6c
SHA256

d03243891b8541db53a73e88eadcc0e06fd4c4f19ae85f5e5bb946fa6c961b02
SHA512

67ac5d9c8460aeb34e623e70bb17ff56b1260666b7a07694eeb235007a3712e327e2106b3c237850eb7f8c94ab4f66a1b2c9289b232f135227fa7b9406d65808
SSDEEP

1536:h3eIPR0EftJoeuskjQspTKAQRLSNj8bLMWECX8iNtQ/:hdOEf5VkssxKAQR2Nj8bLtTZtQ/

Score

N/A

Malware Config

Signatures

Files

d03243891b8541db53a73e88eadcc0e06fd4c4f19ae85f5e5bb946fa6c961b02
.exe windows x86

e4d5018239adc4a7d57290e9c40cebd2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
wcschr
_stricmp
strncpy
wcsncpy
strlen
RtlCompareMemory
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
memset
KeInitializeMutex
KeWaitForSingleObject
KeReleaseMutex
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
KeQuerySystemTime
_aulldiv
RtlUnicodeStringToInteger
RtlTimeToTimeFields
_allmul
KeUnstackDetachProcess
KeStackAttachProcess
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ObfReferenceObject
IoGetRelatedDeviceObject
IoCreateFile
IoAttachDevice
IofCallDriver
IoGetCurrentProcess
_purecall
RtlWriteRegistryValue
RtlCreateRegistryKey
swprintf
ExAllocatePoolWithTag
RtlFreeUnicodeString
MmGetSystemRoutineAddress
strcmp
MmUnlockPages
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
RtlCopyUnicodeString
DbgPrint
KeNumberProcessors
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
PsGetVersion
IoRegisterShutdownNotification
KeSetEvent
KeInitializeEvent
KeGetCurrentThread
ObfDereferenceObject
RtlCompareUnicodeString
ObQueryNameString
ObReferenceObjectByName
IoDriverObjectType
IoFreeIrp
ObInsertObject
IoAllocateIrp
SeSetAccessStateGenericMapping
RtlMapGenericMask
SeCreateAccessState
ObCreateObject
IoFileObjectType
IoBuildDeviceIoControlRequest
IoCancelIrp
KeWaitForMultipleObjects
KeResetEvent
KeClearEvent
IoCreateSynchronizationEvent
KeSetPriorityThread
KeBugCheckEx
MmIsAddressValid
strchr
ZwWriteFile
ZwReadFile
RtlDeleteRegistryValue
memcpy
RtlUnwind

hal

KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KfLowerIrql

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pagecode
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4d5018239adc4a7d57290e9c40cebd2

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 4KB

pagecode Size: 42KB - Virtual size: 41KB

.cdata Size: 1KB - Virtual size: 1KB

INIT Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 4KB

pagecode
Size: 42KB - Virtual size: 41KB

.cdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB