afd47db918f62f0fb2f249e4029e5b1a7d926b8e2cd1495352b426b4ed01bfd0

General

Target

afd47db918f62f0fb2f249e4029e5b1a7d926b8e2cd1495352b426b4ed01bfd0
Size

9KB
MD5

a23e3e57dcc211eb8c0dcdcec4a66a1d
SHA1

4a7b8585283d3e10f50c3887e3390dda2ffddd66
SHA256

afd47db918f62f0fb2f249e4029e5b1a7d926b8e2cd1495352b426b4ed01bfd0
SHA512

5a7c3c80d33072f30efaa1198af86ac7bf2a3734a7632306940ac4ebd3c2cf46d7f73dd282ae4115f78a088dd75819cefd400e7de0bf9fb30a47ebff28225a94
SSDEEP

192:q20y/axStha6LB61FJN0nXDnqIQgHuadFuoADCr6C1pQ1mqUr9qSE:t0yy4tM6dSDIQglQ1Er9qSE

Score

N/A

Malware Config

Signatures

Files

afd47db918f62f0fb2f249e4029e5b1a7d926b8e2cd1495352b426b4ed01bfd0
.exe windows x86

0062f9de8e7480b5ae37ad6f5811be15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_except_handler3
InterlockedIncrement
InterlockedDecrement
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeSetEvent
wcsstr
KeInitializeSpinLock
KeInitializeEvent
ExFreePool
ExAllocatePoolWithTag
strstr
ZwQuerySystemInformation
InterlockedExchange
ZwQueryDirectoryFile
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ObReferenceObjectByHandle
memmove
_snprintf
PsInitialSystemProcess
KeAttachProcess
ObOpenObjectByPointer
KeServiceDescriptorTable
KeDetachProcess

hal

KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0062f9de8e7480b5ae37ad6f5811be15

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 1KB - Virtual size: 1KB

INIT Size: 1024B - Virtual size: 996B

.rsrc Size: 32B - Virtual size: 16B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 1KB - Virtual size: 1KB

INIT
Size: 1024B - Virtual size: 996B

.rsrc
Size: 32B - Virtual size: 16B

.reloc
Size: 1KB - Virtual size: 1KB