0af7891f890932d6ff7e51abfa44a438b29b66bfc181bb4c942a66d63faf8fc5

Sharing

Copy URL

Twitter E-mail

General

Target

0af7891f890932d6ff7e51abfa44a438b29b66bfc181bb4c942a66d63faf8fc5
Size

21KB
MD5

092004f29e2506b337ad2379c45db5f0
SHA1

197345b4dd94bebf5979b696c51e0461e6b2576b
SHA256

0af7891f890932d6ff7e51abfa44a438b29b66bfc181bb4c942a66d63faf8fc5
SHA512

6613dc7763c02047eb7d8dc904090e6f358438731b34d9f3fd8e032ddb7a69292900f125359112f20f835ed21be0447411006010b196984eaefe5ee850909d8f
SSDEEP

384:eA4+ulNMk7iEqgonqxZfzM4sIamFt3N65YSAveeCOmkNlYF8eO18N4PKRypr47HY:h4+eniE0nqxZ6v6urK

Score

N/A

Malware Config

Signatures

Files

0af7891f890932d6ff7e51abfa44a438b29b66bfc181bb4c942a66d63faf8fc5
.exe windows x86

01b18e29fdb3b7e169beabf3200085cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ZwClose
IoFileObjectType
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
strncmp
IoGetCurrentProcess
_strlwr
_strupr
strrchr
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
_stricmp
ObReferenceObjectByHandle
_except_handler3

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

f8VHi
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 864B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t6ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t5ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t4ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t2ata
Size: 256B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t1ata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 852B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01b18e29fdb3b7e169beabf3200085cc

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

f8VHi Size: 4KB - Virtual size: 4KB

.rdata Size: 864B - Virtual size: 840B

.data Size: 8KB - Virtual size: 8KB

.t6ata Size: 256B - Virtual size: 256B

.t5ata Size: 256B - Virtual size: 256B

.t4ata Size: 256B - Virtual size: 256B

.t3ata Size: 256B - Virtual size: 256B

.t2ata Size: 256B - Virtual size: 256B

.t1ata Size: 512B - Virtual size: 512B

.rata Size: 2KB - Virtual size: 2KB

INIT Size: 864B - Virtual size: 852B

.reloc Size: 608B - Virtual size: 606B

f8VHi
Size: 4KB - Virtual size: 4KB

.rdata
Size: 864B - Virtual size: 840B

.data
Size: 8KB - Virtual size: 8KB

.t6ata
Size: 256B - Virtual size: 256B

.t5ata
Size: 256B - Virtual size: 256B

.t4ata
Size: 256B - Virtual size: 256B

.t3ata
Size: 256B - Virtual size: 256B

.t2ata
Size: 256B - Virtual size: 256B

.t1ata
Size: 512B - Virtual size: 512B

.rata
Size: 2KB - Virtual size: 2KB

INIT
Size: 864B - Virtual size: 852B

.reloc
Size: 608B - Virtual size: 606B