afca65d612d475a5473be1d3980833c45658ffd4f828ddead6a14b202d422b59

General

Target

afca65d612d475a5473be1d3980833c45658ffd4f828ddead6a14b202d422b59
Size

8KB
MD5

68d10294dd2603d336afc74cfe439e1a
SHA1

c1bdf644291b659ec23ef82bba6c20b5df46f763
SHA256

afca65d612d475a5473be1d3980833c45658ffd4f828ddead6a14b202d422b59
SHA512

67e7082a785dd82001eac56790576b7a7eb2a90617b9db6e0bd990f405419cc0b960ea72cb2b50ece1e6f3f56eabfb6ad17ad34a4b6d73544ac5091e059f46f2
SSDEEP

96:IR+awi6lWkypegFP4F6BYodYoHMJZfdvCtemQVCbVppjdkzLTKKm:Mwi6ljvjfMsTCBUnKK

Score

N/A

Malware Config

Signatures

Files

afca65d612d475a5473be1d3980833c45658ffd4f828ddead6a14b202d422b59
.exe windows x86

7cfe82d70157e69fa88e2f6578d4898f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memchr
RtlInitString
ZwClose
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
KeGetCurrentThread
RtlFreeAnsiString
KeSetBasePriorityThread
ZwSetInformationThread
ObfDereferenceObject
PsCreateSystemThread
RtlUnicodeStringToAnsiString
ObReferenceObjectByPointer
ObReferenceObjectByHandle
RtlCompareString
strchr
KeServiceDescriptorTable
ZwOpenProcess
PsGetCurrentProcessId
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
IofCompleteRequest
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
memcpy
strstr

hal

ExTryToAcquireFastMutex

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cfe82d70157e69fa88e2f6578d4898f

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 384B - Virtual size: 384B

.data Size: 128B - Virtual size: 36B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 384B - Virtual size: 276B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 384B - Virtual size: 384B

.data
Size: 128B - Virtual size: 36B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 384B - Virtual size: 276B