bed6586c76aef4629eeaaf3ceb5dc6ece76603212206856bce06baece0809c88

Sharing

Copy URL Twitter E-mail

General

Target

bed6586c76aef4629eeaaf3ceb5dc6ece76603212206856bce06baece0809c88
Size

41KB
MD5

60c6559145b7c9c7d59a69eb97b9b18e
SHA1

4a57da793991c40975a3dcbe103c9cffd61baf47
SHA256

bed6586c76aef4629eeaaf3ceb5dc6ece76603212206856bce06baece0809c88
SHA512

802bd5fdb0c25154661a9602e08140b93fb23b841c77f08a071e2877dce011ea2c097a001d5a058fe21513aba05fc3b6bc16060efdc2d47b492956f7737628bb
SSDEEP

768:83zc61nQOxJKGx/8/rsDHSSNEm4k4MnpBFbU7L0CbeQdYyTucTqU8C:gzBQ7GpIKHSSNrtBnpBFbS1eQdYyT2

Score

N/A

Malware Config

Signatures

Files

bed6586c76aef4629eeaaf3ceb5dc6ece76603212206856bce06baece0809c88
.exe windows x86

e891f59ab165cce87c105e5c74a3c236

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeTickCount
KeQueryTimeIncrement
_stricmp
ZwClose
ZwSetInformationFile
ZwCreateFile
RtlInitUnicodeString
wcslen
wcscpy
swprintf
RtlAnsiStringToUnicodeString
_wcsicmp
wcsncpy
wcsrchr
_snwprintf
wcschr
ZwSetValueKey
ZwCreateKey
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
ZwOpenKey
wcsstr
_wcslwr
ObfDereferenceObject
ZwDeleteKey
_except_handler3
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExAllocatePoolWithTag
ObReferenceObjectByHandle
strncmp
RtlCompareUnicodeString
IoDeviceObjectType
MmGetSystemRoutineAddress
wcscat
strncpy
PsLookupProcessByProcessId
ExFreePool
_snprintf
_wcsnicmp
KeQuerySystemTime
RtlCopyUnicodeString
KeDelayExecutionThread
PsCreateSystemThread
IofCompleteRequest
PsSetCreateProcessNotifyRoutine

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEWMI
Size: 32B - Virtual size: 10B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDRV
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGESYS
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEALL
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGECODE
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGERES
Size: 32B - Virtual size: 3B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 96B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e891f59ab165cce87c105e5c74a3c236

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 256B - Virtual size: 252B

.data Size: 7KB - Virtual size: 7KB

PAGEWMI Size: 32B - Virtual size: 10B

PAGEDRV Size: 32B - Virtual size: 8B

PAGESYS Size: 32B - Virtual size: 8B

PAGEALL Size: 32B - Virtual size: 8B

PAGEDATA Size: 32B - Virtual size: 8B

PAGECODE Size: 32B - Virtual size: 8B

PAGERES Size: 32B - Virtual size: 3B

PAGE Size: 96B - Virtual size: 88B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 256B - Virtual size: 252B

.data
Size: 7KB - Virtual size: 7KB

PAGEWMI
Size: 32B - Virtual size: 10B

PAGEDRV
Size: 32B - Virtual size: 8B

PAGESYS
Size: 32B - Virtual size: 8B

PAGEALL
Size: 32B - Virtual size: 8B

PAGEDATA
Size: 32B - Virtual size: 8B

PAGECODE
Size: 32B - Virtual size: 8B

PAGERES
Size: 32B - Virtual size: 3B

PAGE
Size: 96B - Virtual size: 88B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB