fab5290d5d4fa21f4ad04bc72997ba48387002117b8ff182df93a08cf676e9a6

General

Target

fab5290d5d4fa21f4ad04bc72997ba48387002117b8ff182df93a08cf676e9a6
Size

40KB
MD5

98a218c7619d9ca2dde043aa7db5aef1
SHA1

17494a530526c04320608dfd2db8d934609df715
SHA256

fab5290d5d4fa21f4ad04bc72997ba48387002117b8ff182df93a08cf676e9a6
SHA512

dcdfa611fd0b5cca3bff1a4858b43fca8f58939db5fc99aed93b656cf223a6935338dd416382f6ef4d47b5bdc18d1fc56a4c924f57377855cea91fbb8e5f623a
SSDEEP

768:5HPSogqfsXeKhXOpbsbyjZJWs8jC3YJrbrv0xwc0H21eC1gfPdKY5F2Hw:tPtgqfIdTsETS+HmByHdiHw

Score

N/A

Malware Config

Signatures

Files

fab5290d5d4fa21f4ad04bc72997ba48387002117b8ff182df93a08cf676e9a6
.dll windows x86

d4e0639563a45f18308180487483c92e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlNumberGenericTableElements
ExFreePoolWithTag
IoBuildPartialMdl
ExAllocatePool
RtlUpperChar
RtlLookupElementGenericTable
RtlEqualString
IoGetBootDiskInformation
KeClearEvent
RtlCreateHeap
MmMapLockedPages
VerSetConditionMask
RtlFreeHeap
PoUnregisterSystemState
RtlInitUnicodeString
KeSetEvent
RtlDestroyHeap
KeInitializeEvent
RtlInitString
MmBuildMdlForNonPagedPool
RtlCompareString
PoRequestPowerIrp
RtlUnicodeToOemN
RtlUpcaseUnicodeToOemN
PoSetPowerState
IoWritePartitionTableEx
RtlAllocateHeap
KeWaitForSingleObject
IoSetPartitionInformationEx
FsRtlAllocateFileLock
memset

Exports

Exports

_KillEverything@4
_StartKilling@8

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4e0639563a45f18308180487483c92e

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 512B - Virtual size: 269B

.data Size: - Virtual size: 4B

INIT Size: 1024B - Virtual size: 836B

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 512B - Virtual size: 180B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 269B

.data
Size: - Virtual size: 4B

INIT
Size: 1024B - Virtual size: 836B

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 512B - Virtual size: 180B