c50660bcfd5b56c39e3a2b679c0ca5ea60bda544ac34fbb4ac59ed6841397a70

General

Target

c50660bcfd5b56c39e3a2b679c0ca5ea60bda544ac34fbb4ac59ed6841397a70
Size

18KB
MD5

d5cf3b8d3eb00ffef88a06e1972ab59c
SHA1

fb2ffd3520c0b3bee8c7a9ce5206aaf97f6c4172
SHA256

c50660bcfd5b56c39e3a2b679c0ca5ea60bda544ac34fbb4ac59ed6841397a70
SHA512

8a26a32efae7effe5f4235d9e7fc8f60c3847b9a374297174a99061f6b8667e7f9f345c82b66b95f46ae0f85551ea65753c0af14dcaafe989ff8d3d8c3618235
SSDEEP

384:Wb9v3EyuvymGVCa5MIMo8iPjyf6gUGBoPcnZeBma+2kofTBzIX9twd81rPDDR+/1:WRCGG+gkoaX

Score

N/A

Malware Config

Signatures

Files

c50660bcfd5b56c39e3a2b679c0ca5ea60bda544ac34fbb4ac59ed6841397a70
.exe windows x86

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
strrchr
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQueryInformationProcess
ZwReadFile
ZwWriteFile
ZwCreateFile
ZwClose
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vdata
Size: 288B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 982B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 416B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7746aacc60f2b82be6c053118732594

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 16KB - Virtual size: 16KB

zdata Size: 288B - Virtual size: 260B

vdata Size: 288B - Virtual size: 260B

INIT Size: 992B - Virtual size: 982B

.reloc Size: 416B - Virtual size: 388B

.text
Size: 16KB - Virtual size: 16KB

zdata
Size: 288B - Virtual size: 260B

vdata
Size: 288B - Virtual size: 260B

INIT
Size: 992B - Virtual size: 982B

.reloc
Size: 416B - Virtual size: 388B