9a392bf59ac095f8aa3c96e4bc46855f0213f9461173b778a9298cfeb72a34b4

Sharing

Copy URL Twitter E-mail

General

Target

9a392bf59ac095f8aa3c96e4bc46855f0213f9461173b778a9298cfeb72a34b4
Size

147KB
MD5

862a371dfcbd7db03557e6f65cf2d0ff
SHA1

595feaa220b16b1b5191c66550307283cb3b4257
SHA256

9a392bf59ac095f8aa3c96e4bc46855f0213f9461173b778a9298cfeb72a34b4
SHA512

321bbe6a2caf7c02515ff3bb246310f70ef8630c3e403162e2523ddae945022bd4fa22c0246f343d01e46aedbe22b254e9b226eec7f7aeac567ffd7728881ae7
SSDEEP

1536:SDmMNh/ZoDBUbQO8n1xhbrB5JxIrO1HnLLvxkvsOIo+6s:0mTKbQOa175xIrO13JGjRs

Score

N/A

Malware Config

Signatures

Files

9a392bf59ac095f8aa3c96e4bc46855f0213f9461173b778a9298cfeb72a34b4
.exe windows x86

4f43ce0db1c220fd5239bceff4dc7cd3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeBugCheckEx
KeTickCount
KeStackAttachProcess
KeUnstackDetachProcess
ZwCreateFile
KeInitializeApc
ZwReadFile
_allmul
KeDelayExecutionThread
ZwQuerySystemInformation
ExFreePoolWithTag
ExAllocatePoolWithTag
PsLookupProcessByProcessId
PsLookupThreadByThreadId
KeInsertQueueApc
ZwClose
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
KeReadStateEvent
KeResetEvent
ExEventObjectType
ObReferenceObjectByHandle
ObfDereferenceObject
IofCompleteRequest
KeSetEvent
memcpy
PsCreateSystemThread
memset

ndis.sys

NdisGetPoolFromPacket
NdisQueryBuffer
NdisQueryBufferOffset
NDIS_BUFFER_TO_SPAN_PAGES
NdisAllocatePacketPool
NdisAllocateBufferPool
NdisAllocateBuffer
NdisFreeSpinLock
NdisInterlockedDecrement
NdisFreePacketPool
NdisInterlockedIncrement
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisReEnumerateProtocolBindings
NdisIMNotifyPnPEvent
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisFreeMemory
NdisFreeBuffer
NdisDprFreePacket
NdisDeregisterProtocol
NdisOpenProtocolConfiguration
NdisReadConfiguration
NdisAllocateMemoryWithTag
NdisInitializeEvent
NdisAllocatePacketPoolEx
NdisOpenAdapter
NdisIMInitializeDeviceInstanceEx
NdisCloseConfiguration
NdisAllocateSpinLock
NdisInitializeWrapper
NdisIMRegisterLayeredMiniport
NdisMRegisterUnloadHandler
NdisSetEvent
NdisReleaseSpinLock
NdisAcquireSpinLock
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisSend
NdisIMGetCurrentPacketStack
NdisRequest
NdisReturnPackets
NdisTransferData
NdisWaitEvent
NdisCloseAdapter
NdisResetEvent
NdisCancelSendPackets
NdisMRegisterDevice
NdisInitUnicodeString
NdisMSleep
NdisMDeregisterDevice
NdisIMDeregisterLayeredMiniport
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisRegisterProtocol

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 480B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.arch
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f43ce0db1c220fd5239bceff4dc7cd3

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

ndis.sys

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 480B - Virtual size: 480B

.data Size: 640B - Virtual size: 612B

.arch Size: 124KB - Virtual size: 124KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 480B - Virtual size: 480B

.data
Size: 640B - Virtual size: 612B

.arch
Size: 124KB - Virtual size: 124KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB