25d6cb2040324e27bdb76e515e87ac3eb41e448a2d8f540f3cf8aa991db1a8b6

General

Target

25d6cb2040324e27bdb76e515e87ac3eb41e448a2d8f540f3cf8aa991db1a8b6
Size

394KB
MD5

fef4585555d0259b1c64a5d1dabe605e
SHA1

8ffb7fcf3d888aa6c832c9319d60ae43ead2382c
SHA256

25d6cb2040324e27bdb76e515e87ac3eb41e448a2d8f540f3cf8aa991db1a8b6
SHA512

55df7ce45d65c929ae954acdbb66886a3195805a50eaf346565ca9cc1203ac7d297b35125ce640ddad8f9c8a5532ef40926b2c7d8107129d209741a38863709c
SSDEEP

6144:cCiFJVkgIp17Lcp057X6ZTUNfNu7GrACLEWZSjWCkQKkFi57G4TBk:iwjLcx0U4bEWZSsQt4TO

Score

N/A

Malware Config

Signatures

Files

25d6cb2040324e27bdb76e515e87ac3eb41e448a2d8f540f3cf8aa991db1a8b6
.exe windows x86

4ff8145da4cf48ddb474414d4f1420cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
_allmul
_alldiv
ExRaiseStatus
ExAllocatePoolWithTagPriority
ExFreePoolWithTag
RtlCompareUnicodeString
KeReleaseMutex
KeWaitForSingleObject
IoDeleteDevice
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
memset
ExAllocatePoolWithTag
KeInitializeMutex
memcpy
MmGetSystemRoutineAddress
RtlCopyUnicodeString
ZwEnumerateKey
wcsncat
ZwQueryValueKey
ZwCreateKey
ZwReadFile
ZwSetInformationFile
ZwWriteFile
ZwQueryInformationFile
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
swprintf
SeCreateClientSecurity
KeGetCurrentThread
KeQuerySystemTime
sprintf
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
KeTickCount
KeBugCheckEx
ObfDereferenceObject
ZwClose
RtlUnwind

hal

KeGetCurrentIrql

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 768B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ff8145da4cf48ddb474414d4f1420cb

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 338KB - Virtual size: 338KB

.data Size: 3KB - Virtual size: 3KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 768B - Virtual size: 768B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 338KB - Virtual size: 338KB

.data
Size: 3KB - Virtual size: 3KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 768B - Virtual size: 768B

.reloc
Size: 4KB - Virtual size: 3KB