b1c29b02afd5ef694218773d8191bf4e5d263541f24d6ef5a36269d5e5f39042

General

Target

b1c29b02afd5ef694218773d8191bf4e5d263541f24d6ef5a36269d5e5f39042
Size

21KB
MD5

57efbdff488c9db3543d320b49ddc315
SHA1

0121f489c714bae0c0013c63808615faefafabe1
SHA256

b1c29b02afd5ef694218773d8191bf4e5d263541f24d6ef5a36269d5e5f39042
SHA512

88d183437cca137be0eae2f6050e6e1310e406a2a3f7e5e4f0c1950458afcfb709287e926d868a1bf3d55190175ebb77718bd00563279f73a64e33c7989f6f6b
SSDEEP

384:ZrlktChdR1jpperwYslHcD1/tlZEngWb/Wiuf:wWLoYE1/CnVT6

Score

N/A

Malware Config

Signatures

Files

b1c29b02afd5ef694218773d8191bf4e5d263541f24d6ef5a36269d5e5f39042
.exe windows x86

5d1dde690200750916f2e397a95df91c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_except_handler3
RtlInitUnicodeString
IoFreeMdl
MmUnmapLockedPages
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
KeInitializeSpinLock
wcsstr
ExFreePoolWithTag
_wcslwr
wcsncat
wcscat
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
ExAllocatePoolWithTag
_local_unwind2
wcslen
KeGetCurrentThread
_stricmp
ZwQuerySystemInformation
RtlQueryRegistryValues
PsGetCurrentProcessId
IofCompleteRequest
IoDeleteDevice
KeServiceDescriptorTable
wcscpy
ObOpenObjectByName
IoCreateSymbolicLink
IoCreateDevice
wcsncpy
ZwCreateKey
KeTickCount
KeBugCheckEx
MmGetSystemRoutineAddress
RtlAppendUnicodeToString

hal

KeGetCurrentIrql

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d1dde690200750916f2e397a95df91c

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 1024B - Virtual size: 996B

.data Size: 1KB - Virtual size: 1KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 1024B - Virtual size: 996B

.data
Size: 1KB - Virtual size: 1KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 1KB - Virtual size: 1KB