c8e7b0ee7a26bf75a04dbae5cf290276e81e49871daf253a3dbf1289318f4cff

General

Target

c8e7b0ee7a26bf75a04dbae5cf290276e81e49871daf253a3dbf1289318f4cff
Size

8KB
MD5

1eb3938f1cd9f4dbfe8661f800f9cbdd
SHA1

98adf7c8378adc8c7000ad3834bb827990f45518
SHA256

c8e7b0ee7a26bf75a04dbae5cf290276e81e49871daf253a3dbf1289318f4cff
SHA512

dadd713756f3cb9b58d2581fe2a3bcc6165f2a2bce73506b089dc8049029e6a0d44db60a6db1ef347128a32f6763c3d17d90c6d6ff751bdca69e5ccb93e28589
SSDEEP

96:CnRmVCQ57+Lu/nA4Co1RtKKR8oSFZbuPLC5yQCXCDEMRMtryUC+y:uRmoy+Ko4Co/tK4Nu1y2QQ2r1Cb

Score

N/A

Malware Config

Signatures

Files

c8e7b0ee7a26bf75a04dbae5cf290276e81e49871daf253a3dbf1289318f4cff
.exe windows x86

0cc38b3901f5b18e7a8adb41bbaa8c6d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
ExFreePool
strncat
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwEnumerateKey
ZwDeviceIoControlFile
ZwQueryDirectoryFile
ZwCreateKey
ZwSetValueKey
strncmp
IoGetCurrentProcess
wcscmp
_except_handler3
IoDeleteDevice
IoDeleteSymbolicLink
RtlUnicodeStringToAnsiString
ZwClose
ZwUnmapViewOfSection
IofCompleteRequest
_stricmp
IoCreateSymbolicLink
IoCreateDevice
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
ObfDereferenceObject
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
strncpy
RtlInitAnsiString
RtlCompareMemory
PsGetVersion
RtlFreeAnsiString

hal

KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 998B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cc38b3901f5b18e7a8adb41bbaa8c6d

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 320B - Virtual size: 308B

.data Size: 192B - Virtual size: 192B

INIT Size: 1024B - Virtual size: 998B

.reloc Size: 512B - Virtual size: 486B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 320B - Virtual size: 308B

.data
Size: 192B - Virtual size: 192B

INIT
Size: 1024B - Virtual size: 998B

.reloc
Size: 512B - Virtual size: 486B