f89b5fd66740712944f542edb0f7d1dbc28e1863ac3ba17968f6af0167875619

Sharing

Copy URL Twitter E-mail

General

Target

f89b5fd66740712944f542edb0f7d1dbc28e1863ac3ba17968f6af0167875619
Size

201KB
MD5

9ef1fab0a79686a0f9d9876ad749aa37
SHA1

0d1492ea7f7d9130985db6ce34a15a220f3557a6
SHA256

f89b5fd66740712944f542edb0f7d1dbc28e1863ac3ba17968f6af0167875619
SHA512

577b0f81ce1d3c2fc6a507353ecdfcb46ffb47e4837b500398bc9d59577c4aa8e1a9353755692b006c591bf7ca20d28681ba4d22056410ce3a33d7194a76cef4
SSDEEP

3072:HodcYjddniS0+Rp6XcIZ4Qaicl2YuDg3Shjg4ev8K4j50fswecaDoZ/y+hfg+VOU:IXj/ioABRaicoRE3Shjwvg50fs8kku

Score

N/A

Malware Config

Signatures

Files

f89b5fd66740712944f542edb0f7d1dbc28e1863ac3ba17968f6af0167875619
.dll windows x64

bae0340fe418281adf699447a7f1d912

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

win32k.sys

EngCreateSemaphore
EngDeleteSemaphore
EngCreateRectRgn
EngDeleteRgn
EngUnlockSurface
EngDeleteSurface
EngModifySurface
EngAcquireSemaphore
EngReleaseSemaphore
EngCreateDeviceSurface
EngCreateBitmap
EngLockSurface
EngAssociateSurface
EngSetRectRgn
RtlCopyMemoryNonTemporal
CLIPOBJ_cEnumStart
CLIPOBJ_bEnum
EngGetRgnData
EngCombineRgn
EngGetRgnBox
EngRectInRgn
EngIsSemaphoreOwned
EngCTGetGammaTable
EngCreateRedirectionDeviceBitmap
EngCreateDeviceBitmap
EngIsSemaphoreOwnedByCurrentThread
EngQueryW32kCddInterface
EngDeletePalette
EngFreeMem
PALOBJ_cGetColors
EngCopyBits
EngUpdateDeviceSurface
EngAcquireSemaphoreNoWait
EngIsSemaphoreSharedByCurrentThread
EngAcquireSemaphoreSharedNoWait
EngEqualRgn
PATHOBJ_vGetBounds
EngStrokePath
EngBitBlt
XLATEOBJ_iXlate
EngTransparentBlt
EngAlphaBlend
EngGradientFill
EngStretchBlt
EngCopyRgn
EngOffsetRgn
EngTextOut
EngCTGetCurrentGamma
EngLineTo
EngFillPath
EngStrokeAndFillPath
EngStretchBltROP
EngPlgBlt
EngIsCddDeviceBitmap
EngBugCheckEx
EngCreatePalette
EngAllocMem
__C_specific_handler

ntoskrnl.exe

ExQueryWnfStateData
ExIsProcessorFeaturePresent
KeGetRecommendedSharedDataAlignment
ExAllocatePoolWithTag
KeInitializeEvent
RtlQueryRegistryValuesEx
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
KeInitializeMutex
ObfDereferenceObject
MmUnlockPages
MmUnmapViewInSessionSpace
MmCreateSection
MmMapViewInSessionSpace
MmSizeOfMdl
MmProbeAndLockPages
PsGetProcessImageFileName
PsGetCurrentProcess
KeSetEvent
MmUnmapViewOfSection
KeSetActualBasePriorityThread
KeInitializeTimer
KeSetTimer
KeWaitForMultipleObjects
KeReadStateEvent
KeClearEvent
DbgPrintEx
vsprintf_s
KeCancelTimer
ObOpenObjectByPointer
PsCreateSystemThread
KeWaitForSingleObject
ZwClose
ObfReferenceObject
KeStackAttachProcess
KeUnstackDetachProcess
ExAcquirePushLockExclusiveEx
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleasePushLockExclusiveEx
RtlInitUnicodeString
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
IofCallDriver
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlInsertElementGenericTableFullAvl
RtlEnumerateGenericTableAvl
ObDuplicateObject
ObCloseHandle
KeReleaseSemaphore
KeQueryTimeIncrement
IoAllocateMdl
IoFreeMdl
KeInvalidateRangeAllCaches
MmMapViewOfSection
wcsncmp
KeReleaseMutex
ZwSetSystemInformation
_wcsnicmp
KeInitializeSemaphore
ZwQuerySystemInformation
ExFreePoolWithTag

hal

KeQueryPerformanceCounter

watchdog.sys

WdLogEvent5_WdAssertion
WdLogNewEntry5_WdEvent
WdLogEvent5_WdEvent
WdLogNewEntry5_WdWarning
WdLogEvent5_WdWarning
WdLogNewEntry5_WdError
WdLogEvent5_WdError
WdLogNewEntry5_WdLowResource
WdLogEvent5_WdLowResource
WdLogNewEntry5_WdTrace
SMgrGdiCallout
WdLogNewEntry5_WdAssertion

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bae0340fe418281adf699447a7f1d912

Headers

DLL Characteristics

File Characteristics

Imports

win32k.sys

ntoskrnl.exe

hal

watchdog.sys

Sections

.text Size: 173KB - Virtual size: 172KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 6KB - Virtual size: 5KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 512B - Virtual size: 376B

.text
Size: 173KB - Virtual size: 172KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 6KB - Virtual size: 5KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 512B - Virtual size: 376B