c37d19a25eb09b188693b85907124157118907f8bf8bff355848278a465e200b

General

Target

c37d19a25eb09b188693b85907124157118907f8bf8bff355848278a465e200b
Size

21KB
MD5

b025a2db2babf6ae28655a5fcbee89da
SHA1

8a1ceab9fee584b12aa7ea25ffbe6fc4500789c1
SHA256

c37d19a25eb09b188693b85907124157118907f8bf8bff355848278a465e200b
SHA512

44fb31e58c29e2519a49cde08d54a3aeb2660a384e0a3f977d1d3609a8e986305d2478cff7393e055166725fe12f536a3b252394b97c2c8ccec925b7ef203313
SSDEEP

384:bI3v76IJc77mQLEQehlXNTUUTZ8dV5DOXTjTTRTITndd38cLrQR:bI3DbcbLWFNGz5DQTjTTRTITdqcy

Score

N/A

Malware Config

Signatures

Files

c37d19a25eb09b188693b85907124157118907f8bf8bff355848278a465e200b
.exe windows x86

b031864c7de75ccdddd12eec59c02fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
_wcsnicmp
wcslen
strncmp
IoGetCurrentProcess
strncpy
RtlCopyUnicodeString
PsCreateSystemThread
_snwprintf
ExAllocatePoolWithTag
wcsncpy
wcschr
ExFreePool
RtlConvertSidToUnicodeString
ZwQueryInformationToken
ObfDereferenceObject
ObOpenObjectByPointer
PsReferencePrimaryToken
MmGetSystemRoutineAddress
_wcsicmp
wcsrchr
ZwDeleteKey
swprintf
ZwOpenKey
ZwSetValueKey
ZwCreateKey
ZwSetInformationFile
wcscpy
wcsstr
_wcslwr
MmIsAddressValid
ObReferenceObjectByHandle
_stricmp
ZwQueryValueKey
RtlCompareUnicodeString
ObQueryNameString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
PsLookupProcessByProcessId
KeQuerySystemTime
_except_handler3
ZwEnumerateKey
ZwQueryKey
KeDelayExecutionThread
RtlAnsiStringToUnicodeString
_snprintf

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b031864c7de75ccdddd12eec59c02fab

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 5KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 5KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB