cec68041bc16f9438d69a06bff95dd91a60fd69cacb70a475f18dd388635b030

General

Target

cec68041bc16f9438d69a06bff95dd91a60fd69cacb70a475f18dd388635b030
Size

15KB
MD5

af71b8ef96bf92db6478f97584548b83
SHA1

6dd179cf542ae9d10b9b7152e37ac8a054da3d2e
SHA256

cec68041bc16f9438d69a06bff95dd91a60fd69cacb70a475f18dd388635b030
SHA512

4614f6e94c028b290eec07c9e776071d0462a0b5008f8df84c799201c267b3a0f2bb5683b9c1621bd5909843cecd8a7a41d76b7b8d110536aa3a1838d00da3a4
SSDEEP

192:DG7r3+tur0nRvMoeyPkUtSvQV12fNFtAxUuQe2IQ4kLntlq3Kd:DG7j6sGvnVYf1KQlq3Kd

Score

N/A

Malware Config

Signatures

Files

cec68041bc16f9438d69a06bff95dd91a60fd69cacb70a475f18dd388635b030
.exe windows x86

e8704d6182f9efa68cc6e906e6443473

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnlockPages
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
_stricmp
strrchr
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObfDereferenceObject
IoDriverObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeSetEvent
ZwReadFile
ZwQueryInformationFile
KeWaitForSingleObject
KeGetCurrentThread
MmProbeAndLockPages
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
IoGetCurrentProcess
ObReferenceObjectByHandle
IoFileObjectType
_allmul
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
ZwClose
IoFreeIrp

hal

KeStallExecutionProcessor

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 896B - Virtual size: 813B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mcata
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e8704d6182f9efa68cc6e906e6443473

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 896B - Virtual size: 813B

.data Size: 4KB - Virtual size: 4KB

mcata Size: 640B - Virtual size: 520B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 640B - Virtual size: 520B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 896B - Virtual size: 813B

.data
Size: 4KB - Virtual size: 4KB

mcata
Size: 640B - Virtual size: 520B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 640B - Virtual size: 520B