c5be2ee4320101f30f3f82f5270262c51869e2c1aa927fa5e2a00e25af63053a

General

Target

c5be2ee4320101f30f3f82f5270262c51869e2c1aa927fa5e2a00e25af63053a
Size

737KB
MD5

8838cd74a47dfa4937d386b8f8930e7e
SHA1

cb5ccfbe1ffe74bc121cb9ed65ec97389e7a4a4d
SHA256

c5be2ee4320101f30f3f82f5270262c51869e2c1aa927fa5e2a00e25af63053a
SHA512

b59c5a316b400e973c693d6ccf7ae05a0277338b77ed685039f6d89fdfd41e3f2cc876b44dfc1133ab384a4335a188aae93c7af1b27295d4a3ff3625ab8051ee
SSDEEP

12288:gLhfiVmsbHNBmLe+6GFzn3uGRzZmdSoaCqkHaYEQDRqGg1SLXy2uXt2kju5Wb9qH:gLlSXn2TTdneGJ1oaCqkHaYE+qGE+C2b

Score

N/A

Malware Config

Signatures

Files

c5be2ee4320101f30f3f82f5270262c51869e2c1aa927fa5e2a00e25af63053a
.exe windows x86

c87ace0b0a1a23d9a4b6d33d79936dcf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwQuerySystemInformation
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwLoadKey
ZwOpenEvent
RtlInitAnsiString
KeInsertQueueDpc
RtlUnicodeStringToOemString
PoStartNextPowerIrp
ZwQueryDefaultLocale
FsRtlInitializeTunnelCache
FsRtlRemoveMcbEntry
CcIsThereDirtyData
FsRtlSyncVolumes
FsRtlPrepareMdlWrite
KeInitializeTimer
ExRaiseHardError
RtlExtendedMagicDivide
InbvSetTextColor
MmTrimAllSystemPagableMemory
ExSemaphoreObjectType
RtlCreateUnicodeString
strncmp
KeSetTimeIncrement
InterlockedExchangeAdd
wcscat
CcUnpinRepinnedBcb
SeCreateClientSecurityFromSubjectContext
IoCreateDevice
ExDesktopObjectType
IoCreateSymbolicLink
RtlDecompressChunks
RtlUlonglongByteSwap
CcUnpinData
IoQueryFileInformation
RtlTraceDatabaseCreate
MmCreateSection
RtlEqualUnicodeString
IoCheckQuerySetFileInformation
SeAuditHardLinkCreation
CcCopyRead
NtQueryInformationAtom
ZwFreeVirtualMemory
IoGetDeviceProperty
KeDetachProcess

Sections

.text
Size: 333KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c87ace0b0a1a23d9a4b6d33d79936dcf

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 333KB - Virtual size: 332KB

.rdata Size: 512B - Virtual size: 392B

.data Size: 9KB - Virtual size: 23KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 392KB - Virtual size: 391KB

.text
Size: 333KB - Virtual size: 332KB

.rdata
Size: 512B - Virtual size: 392B

.data
Size: 9KB - Virtual size: 23KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 392KB - Virtual size: 391KB