9ba73f0eb26c8a3e64f4f53158746a3480e346ac1d4a94bc64b2e9c38c74ffaf

Sharing

Copy URL

Twitter E-mail

General

Target

9ba73f0eb26c8a3e64f4f53158746a3480e346ac1d4a94bc64b2e9c38c74ffaf
Size

36KB
MD5

86aecebcfdd5cbfb9f352dd02a56c892
SHA1

932c692108cf1f1308e9b79260a2c9e14976b83e
SHA256

9ba73f0eb26c8a3e64f4f53158746a3480e346ac1d4a94bc64b2e9c38c74ffaf
SHA512

285fe2c110754772f6193d73ee93671492a62da2b52021e8e21c10e24690d5cf0f2fc894433a60289e472bcd4cd5c822b6010fa3b50784729c4d87ee96360704
SSDEEP

384:8Duwhf++shYcxoN1DJDnW0jZso8S/ejiOX9pw8lDf04pOvtJWSaHQA:8Duqfa8VJDrjqk/e+E3w8lDs4pOlZs

Score

N/A

Malware Config

Signatures

Files

9ba73f0eb26c8a3e64f4f53158746a3480e346ac1d4a94bc64b2e9c38c74ffaf
.exe windows x86

577b67a1425b75b4e559e5a6c1b22a2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAcquireResourceSharedLite
KeGetCurrentThread
ZwQueryInformationToken
ExFreePool
ExAllocatePoolWithTag
InterlockedIncrement
vsprintf
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
IoGetCurrentProcess
PsReferenceImpersonationToken
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
KeInitializeEvent
memmove
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncmp
PsGetCurrentProcessId
sprintf
ObfDereferenceObject
IoAttachDeviceToDeviceStack
IoCreateDevice
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
ZwCreateFile
RtlInitUnicodeString
IoQueryVolumeInformation
IoAttachDeviceByPointer
KeQuerySystemTime
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ProbeForWrite
_except_handler3
IoDeleteDevice
IoDetachDevice
ExQueueWorkItem
IofCompleteRequest
MmMapLockedPages
IoDeleteSymbolicLink
ExInitializeNPagedLookasideList
ExInitializeResourceLite
IoCreateSymbolicLink
PsReferencePrimaryToken
ObOpenObjectByPointer
ZwClose
_strnicmp
strncpy

hal

KeGetCurrentIrql
KeQueryPerformanceCounter
ExAcquireFastMutex
ExReleaseFastMutex

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 992B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

577b67a1425b75b4e559e5a6c1b22a2d

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 7KB - Virtual size: 7KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 992B - Virtual size: 984B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 7KB - Virtual size: 7KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 992B - Virtual size: 984B

.reloc
Size: 2KB - Virtual size: 2KB