8fef3d3546178dc765edc0ee0157d6cbd9f5b432b3298946c34ac8de757eff13

General

Target

8fef3d3546178dc765edc0ee0157d6cbd9f5b432b3298946c34ac8de757eff13
Size

740KB
MD5

b8bbc99f60551cd54c155de124b003e0
SHA1

9fcc3de42708927789c17b08a73edcac4e1315b1
SHA256

8fef3d3546178dc765edc0ee0157d6cbd9f5b432b3298946c34ac8de757eff13
SHA512

276d2fda639083a9a8ca54a5b9a7955eec5e7127fe0d8a10488994b5b9bb6f9eddd918e98cacbb4f5574b3f92463489c62f45787ec79bebec3c2f0fe6469d1f6
SSDEEP

12288:W/8ISgvSRv9259GriREEB1930vClalApEFkoy90kEoOyXGfSlvy4BtZ/s:W/8cKw59Gr8/3/aSUkQ9KvyQt

Score

N/A

Malware Config

Signatures

Files

8fef3d3546178dc765edc0ee0157d6cbd9f5b432b3298946c34ac8de757eff13
.exe windows x86

91dc95d826acc001a4a39472a2b73e94

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
sprintf
ZwQuerySystemInformation
ExFreePoolWithTag
ExInterlockedPushEntrySList
RtlDeleteRange
SeOpenObjectForDeleteAuditAlarm
ZwQuerySecurityObject
strlen
RtlInitUnicodeString
KeSetProfileIrql
RtlExtendedMagicDivide
IoDriverObjectType
_vsnprintf
IoCreateSymbolicLink
IoCreateDevice
KeI386FlatToGdtSelector
RtlDeleteRegistryValue
MmMapUserAddressesToPage
IoStartPacket
InterlockedDecrement
ZwQueryDefaultUILanguage
KeGetPreviousMode
KiReleaseSpinLock
PsInitialSystemProcess
PoRegisterSystemState
MmGrowKernelStack
CcCanIWrite
IoAllocateErrorLogEntry
RtlCreateSecurityDescriptor
RtlLargeIntegerSubtract
_wcsnicmp
RtlCompareString
RtlSetOwnerSecurityDescriptor
RtlAddAccessAllowedAce
PfxInitialize
IoDeleteDevice
SeTokenIsAdmin
InitSafeBootMode
_wcsrev
FsRtlLookupLastMcbEntry
ZwDeleteKey
memchr
SeSetAccessStateGenericMapping
_except_handler2
LdrFindResource_U
RtlWriteRegistryValue
FsRtlUninitializeFileLock
wcslen
ZwQuerySection
RtlIntegerToChar

Sections

.text
Size: 333KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 227B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91dc95d826acc001a4a39472a2b73e94

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 333KB - Virtual size: 333KB

.rdata Size: 512B - Virtual size: 227B

.data Size: 11KB - Virtual size: 26KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 392KB - Virtual size: 391KB

.text
Size: 333KB - Virtual size: 333KB

.rdata
Size: 512B - Virtual size: 227B

.data
Size: 11KB - Virtual size: 26KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 392KB - Virtual size: 391KB