75eea91f8c38d61ceb7caa2ef40d5538fddcbd3f3ac7c0e95850f07e454f4cf8

Sharing

Copy URL Twitter E-mail

General

Target

75eea91f8c38d61ceb7caa2ef40d5538fddcbd3f3ac7c0e95850f07e454f4cf8
Size

24KB
MD5

06d609744155f03c4ea15203812f279c
SHA1

7cddfa8fa71e1e4774e3ba20c8533c7f7e5f26b3
SHA256

75eea91f8c38d61ceb7caa2ef40d5538fddcbd3f3ac7c0e95850f07e454f4cf8
SHA512

d5425ab555cad7bd955077f66d7e9dde1de6acaf25bdd16d87214dcfd92e9266233acb89244ef74a096c7c89cbfab93d07909946a8c90901b729b36648203c60
SSDEEP

384:+CQ+7UQnTkR8SPLEiWiF3vF/sEUSNvE9u5LqM1C6uhwqOnmB6zTwQTCobhX8Ptn:+D+7DnTG84LTWijUSNvECr1CNGnmBS3

Score

N/A

Malware Config

Signatures

Files

75eea91f8c38d61ceb7caa2ef40d5538fddcbd3f3ac7c0e95850f07e454f4cf8
.exe windows x86

a2d961f1d0c77a919382efbf90a167b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoOpenDeviceRegistryKey
IoReleaseRemoveLockEx
IofCompleteRequest
IoReleaseCancelSpinLock
KeSetEvent
KeWaitForSingleObject
KeInitializeEvent
memmove
RtlCopyUnicodeString
RtlQueryRegistryValues
RtlAppendUnicodeToString
ObfDereferenceObject
IoRegisterPlugPlayNotification
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoBuildDeviceIoControlRequest
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoUnregisterPlugPlayNotification
IoFreeWorkItem
DbgPrint
IoQueueWorkItem
IoAcquireRemoveLockEx
IoAllocateWorkItem
PoCallDriver
PoStartNextPowerIrp
ZwClose
IoFreeIrp
PoRequestPowerIrp
IoAllocateIrp
SeSinglePrivilegeCheck
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PoSetSystemState
IoDeleteDevice
RtlFreeUnicodeString
KeInitializeSpinLock
IoInitializeRemoveLockEx
IoCreateDevice
IoSetDeviceInterfaceState
IoWMIRegistrationControl
IoCancelIrp
ZwSetValueKey
RtlWriteRegistryValue
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoRegisterDeviceInterface
ZwOpenKey
IoAttachDeviceToDeviceStack
IoRegisterDriverReinitialization
KeTickCount
KeBugCheckEx
VerSetConditionMask
RtlVerifyVersionInfo
ZwPowerInformation
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwQueryValueKey
ExFreePoolWithTag
PoSetPowerState
IofCallDriver

hal

KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfReleaseSpinLock

wmilib.sys

WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 433B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 896B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2d961f1d0c77a919382efbf90a167b7

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wmilib.sys

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 512B - Virtual size: 433B

.data Size: 896B - Virtual size: 892B

PAGE Size: 6KB - Virtual size: 6KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 512B - Virtual size: 433B

.data
Size: 896B - Virtual size: 892B

PAGE
Size: 6KB - Virtual size: 6KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1KB - Virtual size: 1KB