f32e0d2f3e65b9453d2264b580c0401f40cf34d7da6ecc0faae84828dbd6f824

General

Target

f32e0d2f3e65b9453d2264b580c0401f40cf34d7da6ecc0faae84828dbd6f824
Size

137KB
MD5

9bdaac429baf2045e268de8a1b382aa1
SHA1

84f7cf6e11a713a62f97249ad9adcddcf62a1269
SHA256

f32e0d2f3e65b9453d2264b580c0401f40cf34d7da6ecc0faae84828dbd6f824
SHA512

69acfdaa45b542b9fdd4ba2ad26325a4a7510a9018838b79a8c6bee5788ef3bc21608a4fafb3f38d26a8ff631e69a783e1398dcc14d66fb4c0227369428dcd7d
SSDEEP

3072:a29AjK/n/cKzq4Pr+9GMKkvCwnKaSXN7pSASQ0I4QT:f9AW/n/pzq4T+9GvPjakw0

Score

N/A

Malware Config

Signatures

Files

f32e0d2f3e65b9453d2264b580c0401f40cf34d7da6ecc0faae84828dbd6f824
.exe windows x86

be585f2b027e0180b4c3ceed4e0a41ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
RtlUnicodeStringToAnsiString
KeInitializeSpinLock
sprintf
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
RtlFreeAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
PsCreateSystemThread
IoCreateDevice
IoDeleteDevice
strncmp
strstr
KeQuerySystemTime
strncpy
MmIsAddressValid
RtlImageDirectoryEntryToData
tolower
ExAllocatePool
ExFreePool
isupper
ZwQuerySystemInformation
ZwDeleteFile
ZwOpenFile
ZwQueryInformationFile
ZwReadFile
RtlInitAnsiString
ZwQueryDirectoryFile
MmMapLockedPages
swprintf
KeDelayExecutionThread
ZwQueryValueKey
isdigit
RtlCompareUnicodeString
wcstombs
ZwEnumerateKey
ZwOpenKey
_wcsicmp
PsTerminateSystemThread
KeTickCount
ZwDeleteValueKey
ZwEnumerateValueKey
ZwDeleteKey
ZwCreateKey
ZwSetValueKey
ZwCreateFile
ZwWriteFile
ExAllocatePoolWithTag
ExFreePoolWithTag
KeReadStateSemaphore
KeInitializeSemaphore
KeReleaseSemaphore
RtlTimeToTimeFields
isspace
strchr
toupper
memcpy
memset
_except_handler3

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be585f2b027e0180b4c3ceed4e0a41ec

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 93KB - Virtual size: 93KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 20KB - Virtual size: 19KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 93KB - Virtual size: 93KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 20KB - Virtual size: 19KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB