a126611bcb59a99d064aeaf5ade56062cb7e477a0b324a3260d27bf39b06870b

Sharing

Copy URL Twitter E-mail

General

Target

a126611bcb59a99d064aeaf5ade56062cb7e477a0b324a3260d27bf39b06870b
Size

46KB
MD5

091daaa1711520075a0d196e3a11295a
SHA1

7c8e5df7b6e37382bde32b440212cdcf443614b3
SHA256

a126611bcb59a99d064aeaf5ade56062cb7e477a0b324a3260d27bf39b06870b
SHA512

a8eb1cde0b22b29e2434f2f8b54934932a6a31bcd03637c44614844292e57a1deff6af0465a4f85c0f3e10550975a78f258339cc12b939523bbff28dcf10ed03
SSDEEP

768:UTypfbBKYnlFJE3UNhmKxTUTlbHt+dwgfwd3OhEepe5C3+qQaxCw:JjBnnlFO3UbmKxoTlDt+/fwd+/pr3X11

Score

N/A

Malware Config

Signatures

Files

a126611bcb59a99d064aeaf5ade56062cb7e477a0b324a3260d27bf39b06870b
.dll windows x86

6b581bd2d6e9f2536d676c687b1111e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePool
ExAllocatePool
memcpy
KeUpdateSystemTime
RtlImageNtHeader
KeWaitForSingleObject
KeQueryTimeIncrement
strcpy
RtlInitializeSid

classpnp.sys

ClassWmiFireEvent
ClassCreateDeviceObject
ClassGetVpb
ClassInitialize
ClassSetFailurePredictionPoll
ClassForwardIrpSynchronous
ClassNotifyFailurePredicted
ClassIoComplete
ClassQueryTimeOutRegistryValue
ClassCleanupMediaChangeDetection
ClassDisableMediaChangeDetection
ClassDebugPrint
ClassSendDeviceIoControlSynchronous
ClassReleaseChildLock
ClassMarkChildMissing
ClassCheckMediaState
ClassAsynchronousCompletion

hal

KeAcquireSpinLockRaiseToSynch
HalSetEnvironmentVariable
HalQueryRealTimeClock
HalReadDmaCounter
WRITE_PORT_UCHAR
KfLowerIrql
HalInitializeProcessor
HalGetAdapter
HalCalibratePerformanceCounter
WRITE_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_UCHAR
READ_PORT_UCHAR
KeAcquireQueuedSpinLock

Exports

Exports

DxLlmznkiKr
PgaoooIuvsXijibhlLqk
YwuKcvtRkbjzXe
GnXwxtxyc
JgfNzlpGxe
Offd
UgjabddWrljr
KnisupPaxromXnhddx
XtqiwgOtgdhax
ZtGfpbzTillwHcos
UorQicnswrDqdlokHkcmrzLk
Nndwfg
OponxMnjrzzyWzfnpzmTr
CbdjRkul
VtKdbzwyPrasnLklk
NdkhzCqeqtpn
KwzVvrodakJowlZouaxrnBu
XrsUewxbjrCrnwnYmkambMh

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 38B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b581bd2d6e9f2536d676c687b1111e1

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

classpnp.sys

hal

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 38KB - Virtual size: 102KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 38B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 38KB - Virtual size: 102KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 38B