81dd8dfb26cfa6248bfc423093675da216c50a282647f9de8676d52ce71f4658

General

Target

81dd8dfb26cfa6248bfc423093675da216c50a282647f9de8676d52ce71f4658
Size

135KB
MD5

a1fbb5002d9301a063a349540bcc0af3
SHA1

ebd465b8bbf8cb6a6569cde2b479de4fbd929ee7
SHA256

81dd8dfb26cfa6248bfc423093675da216c50a282647f9de8676d52ce71f4658
SHA512

3d77bedcd7fb5c1b6fecf756d00387322dda1d3f8d6f2c81f8dc294ab05308e4e8193c0acfe4c18bb806e6e16c3e7955208ed893c37c083a62160b99f3023fe4
SSDEEP

3072:y4eOnFUUkiJo/KKbk13U7ZEAi0Gv7YHZE76VuLFUSfSEp:zlF9olgRU7Zpi5YHaVLa7

Score

N/A

Malware Config

Signatures

Files

81dd8dfb26cfa6248bfc423093675da216c50a282647f9de8676d52ce71f4658
.exe windows x86

23ffdb7f68f0eafc59fe7b1f07d039a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
RtlDecompressBuffer
KeReadStateEvent
KePulseEvent
MmAdvanceMdl
KeBugCheckEx
ExInterlockedFlushSList
KeSetTimerEx
ExInterlockedAddLargeStatistic
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc
KeCancelTimer
_alldiv
RtlEqualUnicodeString
ExAllocatePoolWithQuota
MmUnmapLockedPages
IoCancelIrp
ExQueueWorkItem
FsRtlMdlReadComplete
KeDetachProcess
FsRtlMdlRead
KeAttachProcess
IoGetRequestorProcess
FsRtlCopyRead
IoQueryFileInformation
_aullrem
PsGetCurrentProcessId
ObFindHandleForObject
ObCloseHandle
ObOpenObjectByName
IoThreadToProcess
KeTickCount
KeInitializeApc
KeInsertQueueApc
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
ObfReferenceObject
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23ffdb7f68f0eafc59fe7b1f07d039a4

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 14KB - Virtual size: 14KB

.INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 236B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 14KB - Virtual size: 14KB

.INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 236B