cbe49c57e6bae056377b9dc3725f0fddaa1cd4fbc80410658c80362b76291a8a

Sharing

Copy URL Twitter E-mail

General

Target

cbe49c57e6bae056377b9dc3725f0fddaa1cd4fbc80410658c80362b76291a8a
Size

248KB
MD5

cbf33508f62903df27485b60dbaff6b7
SHA1

50c3297d37f74343aa383dae06e1eccd2438f8f7
SHA256

cbe49c57e6bae056377b9dc3725f0fddaa1cd4fbc80410658c80362b76291a8a
SHA512

264d1f904530c330b710de346f9f04e42bf2b0d124eb67d8f7604e46744c38edb94bfa12361064f6bdf6ba0f5659b8b8b9fba148dd74d406832231ac82167c3f
SSDEEP

3072:Gy/iiq3CZNEbBYKmszI744BJ6Kp8Bwcg/Fi6oKhxDQ3RmrdRvRoEk1Oc4GJaK:DajQKn8M47p4EoUxDrZRvRK4M

Score

N/A

Malware Config

Signatures

Files

cbe49c57e6bae056377b9dc3725f0fddaa1cd4fbc80410658c80362b76291a8a
.dll windows x86

c1cef9074dd0e5c8dec3eef3f368b3e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeSaveStateForHibernate
KeUpdateSystemTime
KeUpdateRunTime
Kei386EoiHelper
KdEnteredDebugger
KiIpiServiceRoutine
KeProfileInterrupt
KeSetEventBoostPriority
KeWaitForSingleObject
KiDeliverApc
KiDispatchInterrupt
DbgPrint
KeFindConfigurationNextEntry
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
RtlIntegerToUnicodeString
ZwClose
RtlEqualUnicodeString
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlUpperString
RtlInitAnsiString
sprintf
ZwCreateKey
ZwSetValueKey
IoAssignDriveLetters
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
strncpy
_stricmp
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
KiBugCheckData
RtlMoveMemory
KeInitializeSpinLock
MmAllocateMappingAddress
MmUnmapReservedMapping
MmMapLockedPagesWithReservedMapping
MmMapLockedPagesSpecifyCache
MmGetPhysicalAddress
MmAllocateContiguousMemorySpecifyCache
MmFreeContiguousMemory
RtlFindClearBitsAndSet
KeRemoveDeviceQueue
RtlClearBits
ObfDereferenceObject
IoFreeMdl
IoAllocateMdl
_allshr
MmUnmapLockedPages
KeSetEvent
RtlSetBits
IoRegisterPlugPlayNotification
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IoGetDeviceInterfaces
ExQueueWorkItem
KeBugCheckEx
KeInitializeDpc
KeInsertQueueDpc
KeQuerySystemTime
RtlQueryRegistryValues
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeEnterKernelDebugger
KdDebuggerEnabled
KdDebuggerNotPresent
InbvSetScrollRegion
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvSetTextColor
InbvSolidColorFill
InbvResetDisplay
InbvIsBootDriverInstalled
ZwEnumerateValueKey
ZwQueryKey
KiAcquireSpinLock
KiReleaseSpinLock
IoAssignResources
IoAllocateAdapterChannel
ObCreateObject
MmUnlockPagableImageSection
MmLockPagableDataSection
MmMapIoSpace
RtlSetAllBits
RtlInitializeBitMap
KeInitializeDeviceQueue
ObInsertObject
ObReferenceObjectByPointer
IoAdapterObjectType
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
IofCompleteRequest
PoStartNextPowerIrp
ObfReferenceObject
IoReportDetectedDevice
IoCreateDriver
WRITE_REGISTER_UCHAR
PoSetHiberRange
KeSetTargetProcessorDpc
KeSetImportanceDpc
HalPrivateDispatchTable
IoReportHalResourceUsage
KeSetTimeIncrement
MmUnmapIoSpace
MmAllocateContiguousMemory
_except_handler3
RtlTimeFieldsToTime
ZwPowerInformation
ExRegisterCallback
ExCreateCallback
HalDispatchTable
InbvDisplayString
atoi
strstr
KiEnableTimerWatchdog
KeRegisterBugCheckCallback
KeSetProfileIrql
PsGetCurrentProcessId
_aulldiv
_allmul
KeInsertDeviceQueue
DbgBreakPoint

kdcom

KdRestore

Exports

Exports

ExAcquireFastMutex
ExReleaseFastMutex
ExTryToAcquireFastMutex
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAssignSlotResources
HalBeginSystemInterrupt
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalDisableSystemInterrupt
HalDisplayString
HalEnableSystemInterrupt
HalEndSystemInterrupt
HalFlushCommonBuffer
HalFreeCommonBuffer
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetInterruptVector
HalHandleNMI
HalInitSystem
HalInitializeProcessor
HalMakeBeep
HalProcessorIdle
HalQueryDisplayParameters
HalQueryRealTimeClock
HalReadDmaCounter
HalReportResourceUsage
HalRequestIpi
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetProfileInterval
HalSetRealTimeClock
HalSetTimeIncrement
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalSystemVectorDispatchEntry
HalTranslateBusAddress
IoAssignDriveLetters
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockRaiseToSynch
KeAcquireQueuedSpinLock
KeAcquireQueuedSpinLockRaiseToSynch
KeAcquireSpinLock
KeAcquireSpinLockRaiseToSynch
KeFlushWriteBuffer
KeGetCurrentIrql
KeLowerIrql
KeQueryPerformanceCounter
KeRaiseIrql
KeRaiseIrqlToDpcLevel
KeRaiseIrqlToSynchLevel
KeReleaseInStackQueuedSpinLock
KeReleaseQueuedSpinLock
KeReleaseSpinLock
KeStallExecutionProcessor
KeTryToAcquireQueuedSpinLock
KeTryToAcquireQueuedSpinLockRaiseToSynch
KfAcquireSpinLock
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock
READ_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
WRITE_PORT_BUFFER_UCHAR
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INITCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGELK
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK16
Size: 256B - Virtual size: 134B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c1cef9074dd0e5c8dec3eef3f368b3e5

Headers

File Characteristics

Imports

ntoskrnl.exe

kdcom

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.data Size: 41KB - Virtual size: 41KB

INITCONS Size: 512B - Virtual size: 512B

PAGELK Size: 12KB - Virtual size: 12KB

PAGELK16 Size: 256B - Virtual size: 134B

PAGE Size: 11KB - Virtual size: 11KB

PAGEKD Size: 4KB - Virtual size: 4KB

.edata Size: 3KB - Virtual size: 2KB

INIT Size: 14KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 124KB - Virtual size: 124KB

.text
Size: 34KB - Virtual size: 34KB

.data
Size: 41KB - Virtual size: 41KB

INITCONS
Size: 512B - Virtual size: 512B

PAGELK
Size: 12KB - Virtual size: 12KB

PAGELK16
Size: 256B - Virtual size: 134B

PAGE
Size: 11KB - Virtual size: 11KB

PAGEKD
Size: 4KB - Virtual size: 4KB

.edata
Size: 3KB - Virtual size: 2KB

INIT
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 124KB - Virtual size: 124KB