3ddd31e2c182034d0cffc6df1501520d8e9f058cb6c40ce2fab5398650d89e12

Sharing

Copy URL

Twitter E-mail

General

Target

3ddd31e2c182034d0cffc6df1501520d8e9f058cb6c40ce2fab5398650d89e12
Size

67KB
MD5

e8a07202bf45dff4acc26a28df796328
SHA1

0a6568c9ddc82f688e9536d63f8970f71f6bf1a0
SHA256

3ddd31e2c182034d0cffc6df1501520d8e9f058cb6c40ce2fab5398650d89e12
SHA512

5130f12cf16f3a4db4d976c7044f8a42bcd85b44a8f2c8892983c004dd8b6302c93d7548fcfaa29810a8755d52ac10e8a4b2562f4cc7667d7aebb96ff6323343
SSDEEP

1536:24aqI5qaXwsmDxBCCSmcJA7kuzDM5zDMpzDMAkgL:24lI5qamdyA7F9L

Score

N/A

Malware Config

Signatures

Files

3ddd31e2c182034d0cffc6df1501520d8e9f058cb6c40ce2fab5398650d89e12
.exe windows x86

fe665b2faad881225b374e115603ab52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoGetDmaAdapter
KeSynchronizeExecution
KeCancelTimer
MmUnmapIoSpace
IoFreeWorkItem
IofCompleteRequest
PoCallDriver
IofCallDriver
KeInitializeTimer
ZwClose
PoSetPowerState
RtlInitUnicodeString
KeInsertQueueDpc
KeInitializeDpc
KeSetEvent
KeClearEvent
ObfDereferenceObject
IoConnectInterrupt
IoDisconnectInterrupt
MmMapIoSpace
ObReferenceObjectByHandle
IoAllocateIrp
IoFreeIrp
KeWaitForSingleObject
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
InterlockedExchange
KeReleaseMutex
IoDetachDevice
InterlockedIncrement
InterlockedDecrement
IoCancelIrp
KeInitializeSpinLock
RtlFreeUnicodeString
IoFreeMdl
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
IoDeleteSymbolicLink
IoQueueWorkItem
IoCsqInsertIrp
IoCsqRemoveIrp
IoCsqRemoveNextIrp
IoCsqInitialize
MmBuildMdlForNonPagedPool
MmSizeOfMdl
KeInitializeEvent
KeSetTimer
KeSetTimerEx
IoAttachDeviceToDeviceStack
RtlAppendUnicodeStringToString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwOpenKey
ZwCreateKey
memmove
RtlCopyUnicodeString
KeInitializeMutex
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeRemoveEntryDeviceQueue
PoStartNextPowerIrp
MmMapLockedPages
ExFreePool
PoRequestPowerIrp
ExAllocatePoolWithTag

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor
WRITE_PORT_ULONG
WRITE_PORT_UCHAR
READ_PORT_UCHAR

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 128B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.STL
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe665b2faad881225b374e115603ab52

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 48KB - Virtual size: 48KB

.data Size: 9KB - Virtual size: 9KB

.CRT Size: 128B - Virtual size: 12B

.STL Size: 128B - Virtual size: 16B

PAGE Size: 2KB - Virtual size: 2KB

INIT Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 48KB - Virtual size: 48KB

.data
Size: 9KB - Virtual size: 9KB

.CRT
Size: 128B - Virtual size: 12B

.STL
Size: 128B - Virtual size: 16B

PAGE
Size: 2KB - Virtual size: 2KB

INIT
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB