c95e9a998c228c21f60aafd3c50b98e6a6063e575ef3e4b6ec203e6e85d9b6cd

General

Target

c95e9a998c228c21f60aafd3c50b98e6a6063e575ef3e4b6ec203e6e85d9b6cd
Size

13KB
MD5

e1ff6c3859334963e68cf227ab862886
SHA1

d65dbaaa91d4cef876678489192ccf9bb7c66816
SHA256

c95e9a998c228c21f60aafd3c50b98e6a6063e575ef3e4b6ec203e6e85d9b6cd
SHA512

208fe549831e195d5be465eae7854c082f6005535e077b67bbcf3c407741d3a9294bbca8e58b3a1deb8a3df52a3a8d80572795db0fc1e60021aa69900728d164
SSDEEP

192:89T+9snLzTQ5IZAtBSa3ufzduxirDtNI5+Db:ST+OE5bia+fJuxirDjI

Score

N/A

Malware Config

Signatures

Files

c95e9a998c228c21f60aafd3c50b98e6a6063e575ef3e4b6ec203e6e85d9b6cd
.exe windows x86

0c35d32418dc3aebd156aa05bcb2eba2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
ExGetPreviousMode
ProbeForWrite
ProbeForRead
_stricmp
_strupr
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
MmIsAddressValid
_except_handler3
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsTerminateSystemThread
ExFreePool
ZwQuerySystemInformation
ZwPulseEvent
MmGetSystemRoutineAddress
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 864B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 946B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 448B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c35d32418dc3aebd156aa05bcb2eba2

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 864B - Virtual size: 856B

.data Size: 7KB - Virtual size: 7KB

INIT Size: 960B - Virtual size: 946B

.reloc Size: 448B - Virtual size: 424B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 864B - Virtual size: 856B

.data
Size: 7KB - Virtual size: 7KB

INIT
Size: 960B - Virtual size: 946B

.reloc
Size: 448B - Virtual size: 424B