ac0eb7bdebdfde19a45ec1c5993fe822989ced8c0e36a0ef729f890e6ff389a8

General

Target

ac0eb7bdebdfde19a45ec1c5993fe822989ced8c0e36a0ef729f890e6ff389a8
Size

78KB
MD5

e8547e6029b16833eaddaefce7305833
SHA1

be868d5317cbdec296dcda3c81820adb2fc918fe
SHA256

ac0eb7bdebdfde19a45ec1c5993fe822989ced8c0e36a0ef729f890e6ff389a8
SHA512

d689f99c6d93525555d9b9dd4ab96714a971efeeed16c861c1ca831246dd8c0fa9d3bab69226791ad31dc13cf3c40c35882b33036e4b851d97b545be5a9f4ff6
SSDEEP

1536:/fpavZJ1yxUD0mYlyOYC/bCkmtrS/YKZLVVKLd+633ZfqVFdVw6Fy:/fpygUD0BUXkmt2BVVKZ+79D

Score

N/A

Malware Config

Signatures

Files

ac0eb7bdebdfde19a45ec1c5993fe822989ced8c0e36a0ef729f890e6ff389a8
.exe windows x86

fa5367a40a7a9f184717d35bf62b9b76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwAllocateVirtualMemory
ZwFreeVirtualMemory
rand
srand
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwCreateFile
RtlInitUnicodeString
ZwWriteFile
ZwQueryInformationFile
ZwSetInformationFile
ZwClose
NtBuildNumber
ZwQuerySystemInformation
ZwOpenProcess
ObfDereferenceObject
PsLookupProcessByProcessId
RtlEqualUnicodeString
ZwQueryInformationToken
ObOpenObjectByPointer
PsReferencePrimaryToken
ZwQueryInformationProcess
KeDelayExecutionThread
PsCreateSystemThread
ZwOpenKey
ZwDeleteKey
ObQueryNameString
RtlCompareUnicodeString
ObReferenceObjectByHandle
ObOpenObjectByName
KeWaitForSingleObject
KeInitializeEvent
wcslen
IoDriverObjectType
ObReferenceObjectByName
RtlUnicodeStringToInteger
wcsncmp
MmMapLockedPagesSpecifyCache
KeBugCheck
KeReleaseMutex
KeUnstackDetachProcess
KeStackAttachProcess
ExEventObjectType
ZwCreateEvent
wcscat
wcscpy
ZwTerminateProcess
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeInitializeMutex
KeSetEvent
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQueryValueKey
MmIsAddressValid

hal

KeGetCurrentIrql

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa5367a40a7a9f184717d35bf62b9b76

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 512B - Virtual size: 468B

.data Size: 63KB - Virtual size: 63KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 512B - Virtual size: 468B

.data
Size: 63KB - Virtual size: 63KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB