b00894ab4d25a6f0d6d7b2eb0ec8dc6634a3dc40112953d1a8a06a57618dea67

Sharing

Copy URL

Twitter E-mail

General

Target

b00894ab4d25a6f0d6d7b2eb0ec8dc6634a3dc40112953d1a8a06a57618dea67
Size

163KB
MD5

f2a2244315362b179fd73ff89198bb87
SHA1

9b9a498a29ef3ecb451cfb0dff62e8a0b8b27e49
SHA256

b00894ab4d25a6f0d6d7b2eb0ec8dc6634a3dc40112953d1a8a06a57618dea67
SHA512

429144a764731ba177eed32a2a67ee047e2dbe54c6a0fea71522e29755ad807248453f1a5f8251281454861f2a4565bbd9f7708676ccea6756aee32e1020ed5b
SSDEEP

3072:fpMFooeHGEvlFvPq84e4ZgKyiQndZ2+W2bk1clZzW+lJwH:KFooeVDPq84ewzQndmwzW+4

Score

N/A

Malware Config

Signatures

Files

b00894ab4d25a6f0d6d7b2eb0ec8dc6634a3dc40112953d1a8a06a57618dea67
.exe windows x86

ee18a8fec793a10d973e71412e7477b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeWaitForSingleObject
KeInitializeSpinLock
RtlFreeAnsiString
RtlFreeUnicodeString
IoDeleteDevice
sprintf
KeSetEvent
PsCreateSystemThread
RtlUnicodeStringToAnsiString
ZwClose
IoCreateDevice
KeQuerySystemTime
strncpy
strncmp
strstr
MmIsAddressValid
IoUnregisterFsRegistrationChange
IoRegisterFsRegistrationChange
IoAllocateMdl
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
wcsncpy
RtlInitAnsiString
wcsncat
IoFreeMdl
IoDriverObjectType
MmProbeAndLockPages
MmUnlockPages
ObReferenceObjectByName
KeDelayExecutionThread
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
tolower
ExAllocatePool
ExFreePool
isupper
ObReferenceObjectByHandle
RtlImageDirectoryEntryToData
ZwQueryDirectoryFile
ZwDeleteFile
ZwOpenFile
isdigit
ZwQueryDirectoryObject
_wcsicmp
RtlCompareUnicodeString
MmMapLockedPages
ZwOpenDirectoryObject
ZwQueryValueKey
KeServiceDescriptorTable
ZwLoadDriver
ZwEnumerateKey
ZwOpenKey
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
ZwEnumerateValueKey
strchr
RtlInitUnicodeString
RtlTimeToTimeFields
KeInitializeEvent
PsTerminateSystemThread
KeTickCount
ZwFlushKey
ZwDeleteKey
KeInitializeSemaphore
KeReleaseSemaphore
KeReadStateSemaphore
toupper
isspace
RtlAnsiStringToUnicodeString
IofCompleteRequest
ZwQuerySystemInformation
memcpy
memset
_except_handler3
_allrem

hal

KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee18a8fec793a10d973e71412e7477b0

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 128KB - Virtual size: 128KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 5KB - Virtual size: 24KB

INIT Size: 3KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 128KB - Virtual size: 128KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 5KB - Virtual size: 24KB

INIT
Size: 3KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 8KB