c31276887a759fe01b7d605d1ab443d80cb36dabbaef65dfc6db3d22105bbb38

General

Target

c31276887a759fe01b7d605d1ab443d80cb36dabbaef65dfc6db3d22105bbb38
Size

18KB
MD5

6430d417a5fb5572e3d0c230ced95429
SHA1

55d89f70a61e5fb5cdeaf3f3cdfafdc28f0c4089
SHA256

c31276887a759fe01b7d605d1ab443d80cb36dabbaef65dfc6db3d22105bbb38
SHA512

cd6d0618ac52f0ff12040fcab63ed2286ae112ebdf40aef2afc0b983b542c6cd8e32e4508b81841d3929648c3da0432110bceef2b2d0f8cfdd720d6357724238
SSDEEP

384:49v3EyuvymGVCa5MIMo8iPjyf6gUGBoPcnZeBma+2kofTBzIX9twd81rPDDR+/2a:aCGG+gkoaX

Score

N/A

Malware Config

Signatures

Files

c31276887a759fe01b7d605d1ab443d80cb36dabbaef65dfc6db3d22105bbb38
.exe windows x86

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQueryInformationProcess
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwClose
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 982B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 416B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 16KB

zdata Size: 288B - Virtual size: 260B

vdata Size: 288B - Virtual size: 260B

INIT Size: 992B - Virtual size: 982B

.reloc Size: 416B - Virtual size: 388B

.text
Size: 16KB - Virtual size: 16KB

zdata
Size: 288B - Virtual size: 260B

vdata
Size: 288B - Virtual size: 260B

INIT
Size: 992B - Virtual size: 982B

.reloc
Size: 416B - Virtual size: 388B