ed61238da979b6ddba8a339bcf5b94c8ac2e2b4586c9c7c4a244133cec940a55

General

Target

ed61238da979b6ddba8a339bcf5b94c8ac2e2b4586c9c7c4a244133cec940a55
Size

722KB
MD5

3d39ff03c1d13ce73c8ac8956209d65a
SHA1

81da87ac6ec6b9f5182a36a0efb60e171c2b00d0
SHA256

ed61238da979b6ddba8a339bcf5b94c8ac2e2b4586c9c7c4a244133cec940a55
SHA512

d43aa8d0a663f99dfcb3111ca87c49a52c6f34d0b1f730817e5ce2d411aecc2c760b47921a5a7224c13640cd4bb2c0f150ca4984cede1844830f3a0a28658ddd
SSDEEP

12288:tgDXpELoqyO2HbkL5xcHYVkiKTWDVFTPc4JGNB8LPxfRaN3pSZG6bd9Bxt/aDhOP:EEolHbk/cckiKQNcYYa6ZSJ8DU

Score

N/A

Malware Config

Signatures

Files

ed61238da979b6ddba8a339bcf5b94c8ac2e2b4586c9c7c4a244133cec940a55
.exe windows x86

8ab9dd31a981b7f6110fa2cbac5e4bf0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
RtlInitUnicodeString
KeWaitForSingleObject
IofCallDriver
ZwClose
ExFreePoolWithTag
IoDeleteDevice
IoCreateDevice
IoFreeIrp
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
IoDetachDevice
RtlFreeUnicodeString
IoFreeMdl
KeCancelTimer
IoQueueWorkItem
IoAllocateMdl
KeInitializeTimer
IoAllocateWorkItem
KeAcquireSpinLockAtDpcLevel
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
DbgPrint
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoInitializeRemoveLockEx
ObfReferenceObject
MmMapIoSpace
KeQueryTimeIncrement
_vsnprintf
RtlIntegerToUnicodeString
KeWaitForMultipleObjects
MmProbeAndLockPages
IoInvalidateDeviceRelations
MmUnlockPages
KeRemoveQueueDpc
ZwQuerySystemInformation

Sections

.text
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 986B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 385KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ab9dd31a981b7f6110fa2cbac5e4bf0

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 318KB - Virtual size: 317KB

.rdata Size: 512B - Virtual size: 152B

.data Size: 14KB - Virtual size: 14KB

INIT Size: 1024B - Virtual size: 986B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 385KB - Virtual size: 385KB

.text
Size: 318KB - Virtual size: 317KB

.rdata
Size: 512B - Virtual size: 152B

.data
Size: 14KB - Virtual size: 14KB

INIT
Size: 1024B - Virtual size: 986B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 385KB - Virtual size: 385KB