a749513f1cc7112a66ab5842ada78dcfddaac42ae346ca5412858684e26a47be

General

Target

a749513f1cc7112a66ab5842ada78dcfddaac42ae346ca5412858684e26a47be
Size

112KB
MD5

041ef1d29eac4a8667aec0bd7ef7ec2e
SHA1

a64259cc93cd461d82718b627c07ea2bef161d1f
SHA256

a749513f1cc7112a66ab5842ada78dcfddaac42ae346ca5412858684e26a47be
SHA512

e060198829a1ba9279ff001c84436d606daaf8967e948532725af82205564ac1f708da61713f30aa410b13ba46e7f7023c0d07b3b4c1308cd64a509a9af5e303
SSDEEP

1536:SrwuvGCt9RZIkDIzpuIVCm+f1coVUqFRKyZ8zQuXzhnyGL5KOFx:vatIaIIfm81coVUqSwGhyGL5Kg

Score

N/A

Malware Config

Signatures

Files

a749513f1cc7112a66ab5842ada78dcfddaac42ae346ca5412858684e26a47be
.exe windows x86

21e5e4c4e55f81c888408c561abdc0ab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDriverObjectType
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
ExFreePoolWithTag
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
IoBuildAsynchronousFsdRequest
memset
DbgPrint
RtlCompareMemory
IofCompleteRequest
ZwClose
ExAllocatePool
ZwQueryValueKey
ZwOpenKey
wcsstr
_wcsnset
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
ZwSetValueKey
ObReferenceObjectByName
ZwPulseEvent
ZwAllocateVirtualMemory
ObOpenObjectByPointer
ProbeForRead
IoGetCurrentProcess
strstr
_strupr
PsGetProcessImageFileName
PsLookupProcessByProcessId
_wcsupr
memcpy
PsRemoveLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutine
IoCreateFile
KeGetCurrentThread
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
PsSetCreateProcessNotifyRoutine
IoRegisterShutdownNotification
PsGetVersion
IoCreateDevice
KeTickCount
KeBugCheckEx
RtlUnwind
ZwCreateKey
ObfDereferenceObject

hal

KeGetCurrentIrql

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21e5e4c4e55f81c888408c561abdc0ab

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 512B - Virtual size: 484B

.data Size: 100KB - Virtual size: 104KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 512B - Virtual size: 484B

.data
Size: 100KB - Virtual size: 104KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 1024B