df9a99c9abda24ebfaf2bbe18ac36ea8dd10525f4df600d0a2cd23d6dbd80da7

General

Target

df9a99c9abda24ebfaf2bbe18ac36ea8dd10525f4df600d0a2cd23d6dbd80da7
Size

39KB
MD5

ac0760d877cbf501b5b3264fa0ad2801
SHA1

020593203800c68f2d4ab8379732cdf167daa2d2
SHA256

df9a99c9abda24ebfaf2bbe18ac36ea8dd10525f4df600d0a2cd23d6dbd80da7
SHA512

873ec0ef24f55947078766a7595f35e2c4c9b8d82059672672ecaf04e6b0e1b114691f4e309d68ab43dede2411cdf5a54c15590e202c8eabd21dd6f38641b610
SSDEEP

768:pBiD5+oUknDWvToRGqgPRmTuY7b5CMWqJnnQBK6yIxxZotFB6qYJ:q5+oURiG1maOYMWqdDhtFIBJ

Score

N/A

Malware Config

Signatures

Files

df9a99c9abda24ebfaf2bbe18ac36ea8dd10525f4df600d0a2cd23d6dbd80da7
.exe windows x86

dc35937eac4da58bd760c4c00d3f8b1a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
ExFreePoolWithTag
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
ExAllocatePoolWithTag
PsLookupProcessByProcessId
_except_handler3
ProbeForWrite
MmIsAddressValid
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation

hal

HalMakeBeep

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 554B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dri0
Size: 256B - Virtual size: 160B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

dri1
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

dri2
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc35937eac4da58bd760c4c00d3f8b1a

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 384B - Virtual size: 292B

.data Size: 128B - Virtual size: 16B

INIT Size: 640B - Virtual size: 554B

dri0 Size: 256B - Virtual size: 160B

dri1 Size: 11KB - Virtual size: 11KB

dri2 Size: 24KB - Virtual size: 24KB

.reloc Size: 384B - Virtual size: 300B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 384B - Virtual size: 292B

.data
Size: 128B - Virtual size: 16B

INIT
Size: 640B - Virtual size: 554B

dri0
Size: 256B - Virtual size: 160B

dri1
Size: 11KB - Virtual size: 11KB

dri2
Size: 24KB - Virtual size: 24KB

.reloc
Size: 384B - Virtual size: 300B