c6354c0c3383a72291419cd9357ed35d9e5d6a35e2a32675aa57c03229759416

General

Target

c6354c0c3383a72291419cd9357ed35d9e5d6a35e2a32675aa57c03229759416
Size

10KB
MD5

f628f6eb39468074ced164b255d3499c
SHA1

11210c20dbf4eb1a8526b56febdd81499b73e86c
SHA256

c6354c0c3383a72291419cd9357ed35d9e5d6a35e2a32675aa57c03229759416
SHA512

e4e457d03aac4fa5d9e79558f4c1b758ef90d559f66b3df8795f760b260961b0e85492ea70975c068fd7797f43401041f22cbaaf46320c5be8cfbe735006229a
SSDEEP

192:2L0yeaG/+udqsbk5lMbt8VK25BkWH36Qv:2BSvqakfC8/n7H33

Score

N/A

Malware Config

Signatures

Files

c6354c0c3383a72291419cd9357ed35d9e5d6a35e2a32675aa57c03229759416
.exe windows x86

c8929caad0cd7f7a03ac3295e9576957

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
IoFreeMdl
MmUnmapLockedPages
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
ExAllocatePoolWithTag
wcslen
IoCreateSymbolicLink
IoCreateDevice
ZwQueryInformationFile
ZwAdjustPrivilegesToken
ZwOpenProcessToken
ExFreePoolWithTag
ZwClose
ZwReadFile
ZwCreateFile
wcscmp
_alldiv
ObReferenceObjectByHandle
ZwOpenProcess
ZwQuerySystemInformation
_strnicmp
MmIsAddressValid
MmHighestUserAddress
KeDetachProcess
ZwQueryInformationProcess
KeAttachProcess
KeTickCount
KeBugCheckEx

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 970B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 534B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8929caad0cd7f7a03ac3295e9576957

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 512B - Virtual size: 236B

.data Size: 512B - Virtual size: 4KB

INIT Size: 1024B - Virtual size: 970B

.reloc Size: 1024B - Virtual size: 534B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 236B

.data
Size: 512B - Virtual size: 4KB

INIT
Size: 1024B - Virtual size: 970B

.reloc
Size: 1024B - Virtual size: 534B