ntoskrnl[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ntoskrnl.exe
Size

1.5MB
MD5

325ba209a89f8ac1a9d30a6f34bd8bdc
SHA1

21b8a3cad23c3bac4b94fd3403295995e2396234
SHA256

a37895d08a0ddc5fa31ba458175b3819d3c1473681f5055ee95960d0c791c72f
SHA512

641379fd91b650635349ffd7d899d2de4ec2bd0d5643fa475cde42286ce0dc6289b33218674395a15d864cd925876ec65499c31538bec005edc8c0608ea73a5f
SSDEEP

12288:iCWCSEuQu+D7Teve8wOwXkFce7o+VoNlEJe6SejqQtWvYYmGGza:iCW5Quue2Tr1R+VEEesWvYYmGGza

Score

1^/10

Malware Config

Signatures

Files

ntoskrnl.exe
.dll windows x64

940e2d04bf78ff4a05c8ccf3759f1bcb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
RegCloseKey
RegOpenKeyW
RegQueryValueExW
SetServiceStatus
SystemFunction036

kernel32

CloseHandle
CloseThreadpool
CloseThreadpoolTimer
CreateEventW
CreateMutexW
CreateSemaphoreW
CreateThreadpool
CreateThreadpoolTimer
DelayLoadFailureHook
DisableThreadLibraryCalls
EnterCriticalSection
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FreeLibrary
GetActiveProcessorCount
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetSystemDirectoryW
GetTickCount
GetVersion
GetWindowsDirectoryW
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
IsWow64Process
LeaveCriticalSection
LoadLibraryExW
OpenProcess
OpenThread
RaiseException
ReleaseSemaphore
ResetEvent
ResolveDelayLoadedAPI
RtlCaptureContext
RtlCaptureStackBackTrace
RtlCompareMemory
RtlCopyMemory
RtlFillMemory
RtlLookupFunctionEntry
RtlMoveMemory
RtlPcToFileHeader
RtlRaiseException
RtlRestoreContext
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
RtlZeroMemory
SetEvent
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
SetThreadpoolTimer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TrySubmitThreadpoolCallback
VerSetConditionMask
VirtualAlloc
VirtualFree
VirtualProtect
WaitForMultipleObjectsEx
WaitForThreadpoolTimerCallbacks
lstrcmpiW

msvcrt

__C_specific_handler
__iob_func
_abnormal_termination
_assert
_finite
_i64toa_s
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_local_unwind
_ltoa_s
_ltow_s
_makepath_s
_purecall
_setjmp
_setjmpex
_snprintf
_snprintf_s
_snscanf_s
_snwprintf
_snwprintf_s
_snwscanf_s
_splitpath_s
_strdup
_stricmp
_strlwr
_strnicmp
_strnset
_strnset_s
_strrev
_strset
_strtoui64
_strupr
_swprintf
_ui64toa_s
_ui64tow_s
_ultoa_s
_ultow_s
_vsnprintf
_vsnprintf_s
_vsnwprintf
_vsnwprintf_s
_vswprintf
_wcsicmp
_wcslwr
_wcslwr_s
_wcsnicmp
_wcsnset
_wcsnset_s
_wcsrev
_wcsset_s
_wcsupr
_wmakepath_s
_wsplitpath_s
_wtoi
_wtol
atoi
atol
bsearch
bsearch_s
free
fwrite
getenv
isdigit
islower
isprint
isspace
isupper
iswalnum
iswdigit
iswspace
isxdigit
longjmp
malloc
mbstowcs
mbtowc
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
qsort
qsort_s
rand
sprintf
sprintf_s
sqrt
sqrtf
srand
sscanf_s
strcat
strcat_s
strchr
strcmp
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strrchr
strspn
strstr
strtok_s
swprintf
swprintf_s
swscanf_s
tolower
toupper
towlower
towupper
vsprintf
vsprintf_s
vswprintf_s
wcscat
wcscat_s
wcschr
wcscmp
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcsrchr
wcsspn
wcsstr
wcstombs
wcstoul
wctomb

ntdll

DbgBreakPoint
DbgPrint
DbgPrintEx
LdrAccessResource
LdrFindEntryForAddress
LdrFindResourceDirectory_U
LdrFindResource_U
LdrLockLoaderLock
LdrProcessRelocationBlock
LdrRegisterDllNotification
LdrUnlockLoaderLock
LdrUnregisterDllNotification
NtAccessCheckAndAuditAlarm
NtAddAtom
NtAdjustPrivilegesToken
NtAlertThread
NtAllocateLocallyUniqueId
NtAllocateUuids
NtAllocateVirtualMemory
NtAssignProcessToJobObject
NtCancelIoFile
NtCancelIoFileEx
NtCancelTimer
NtClearEvent
NtClose
NtConnectPort
NtCreateDirectoryObject
NtCreateEvent
NtCreateFile
NtCreateIoCompletion
NtCreateJobObject
NtCreateKey
NtCreateKeyTransacted
NtCreateSection
NtCreateSymbolicLinkObject
NtCreateTimer
NtDelayExecution
NtDeleteAtom
NtDeleteFile
NtDeleteKey
NtDeleteValueKey
NtDeviceIoControlFile
NtDisplayString
NtDuplicateObject
NtDuplicateToken
NtEnumerateKey
NtEnumerateValueKey
NtFindAtom
NtFlushBuffersFile
NtFlushInstructionCache
NtFlushKey
NtFlushVirtualMemory
NtFreeVirtualMemory
NtFsControlFile
NtGetCurrentProcessorNumber
NtGetTickCount
NtImpersonateAnonymousToken
NtInitiatePowerAction
NtIsProcessInJob
NtLoadKey
NtLockFile
NtLockVirtualMemory
NtMakeTemporaryObject
NtMapViewOfSection
NtNotifyChangeDirectoryFile
NtNotifyChangeKey
NtOpenDirectoryObject
NtOpenEvent
NtOpenFile
NtOpenJobObject
NtOpenKey
NtOpenKeyEx
NtOpenKeyTransacted
NtOpenKeyTransactedEx
NtOpenProcess
NtOpenProcessToken
NtOpenProcessTokenEx
NtOpenSection
NtOpenSymbolicLinkObject
NtOpenThread
NtOpenThreadToken
NtOpenThreadTokenEx
NtOpenTimer
NtPowerInformation
NtProtectVirtualMemory
NtPulseEvent
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryDirectoryFile
NtQueryDirectoryObject
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryInstallUILanguage
NtQueryKey
NtQueryLicenseValue
NtQueryObject
NtQuerySection
NtQuerySecurityObject
NtQuerySymbolicLinkObject
NtQuerySystemEnvironmentValueEx
NtQuerySystemInformation
NtQuerySystemInformationEx
NtQuerySystemTime
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtReadFile
NtReadVirtualMemory
NtRemoveIoCompletion
NtRemoveIoCompletionEx
NtRenameKey
NtReplaceKey
NtRequestWaitReplyPort
NtResetEvent
NtRestoreKey
NtSaveKey
NtSecureConnectPort
NtSetDefaultLocale
NtSetDefaultUILanguage
NtSetEaFile
NtSetEvent
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationObject
NtSetInformationProcess
NtSetInformationThread
NtSetInformationToken
NtSetIntervalProfile
NtSetIoCompletion
NtSetSecurityObject
NtSetSystemInformation
NtSetSystemTime
NtSetTimer
NtSetTimerResolution
NtSetValueKey
NtSetVolumeInformationFile
NtShutdownSystem
NtTerminateJobObject
NtTerminateProcess
NtTraceControl
NtUnloadKey
NtUnlockFile
NtUnlockVirtualMemory
NtUnmapViewOfSection
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWriteFile
NtYieldExecution
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlAddAccessAllowedAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedAceEx
RtlAddAccessDeniedObjectAce
RtlAddAce
RtlAddAtomToAtomTable
RtlAddAuditAccessAceEx
RtlAddAuditAccessObjectAce
RtlAddVectoredExceptionHandler
RtlAllocateHeap
RtlAnsiCharToUnicodeChar
RtlAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlAppendAsciizToString
RtlAppendStringToString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlAreBitsClear
RtlAreBitsSet
RtlAssert
RtlCharToInteger
RtlCheckRegistryKey
RtlClearAllBits
RtlClearBits
RtlCompareMemoryUlong
RtlCompareString
RtlCompareUnicodeString
RtlCompareUnicodeStrings
RtlCompressBuffer
RtlComputeCrc32
RtlConvertSidToUnicodeString
RtlCopyExtendedContext
RtlCopyLuid
RtlCopyLuidAndAttributesArray
RtlCopySid
RtlCopyString
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateAtomTable
RtlCreateHeap
RtlCreateRegistryKey
RtlCreateSecurityDescriptor
RtlCreateUnicodeString
RtlCreateUserThread
RtlCustomCPToUnicodeN
RtlDecompressBuffer
RtlDecompressFragment
RtlDeleteAce
RtlDeleteAtomFromAtomTable
RtlDeleteRegistryValue
RtlDestroyAtomTable
RtlDestroyHeap
RtlDowncaseUnicodeChar
RtlDowncaseUnicodeString
RtlDuplicateUnicodeString
RtlEmptyAtomTable
RtlEnumerateGenericTableWithoutSplaying
RtlEqualLuid
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlFillMemoryUlong
RtlFindClearBits
RtlFindClearBitsAndSet
RtlFindClearRuns
RtlFindLastBackwardRunClear
RtlFindLeastSignificantBit
RtlFindLongestRunClear
RtlFindMessage
RtlFindMostSignificantBit
RtlFindNextForwardRunClear
RtlFindSetBits
RtlFindSetBitsAndClear
RtlFirstFreeAce
RtlFormatCurrentUserKeyPath
RtlFormatMessage
RtlFormatMessageEx
RtlFreeAnsiString
RtlFreeHeap
RtlFreeOemString
RtlFreeUnicodeString
RtlGUIDFromString
RtlGetAce
RtlGetCompressionWorkSpaceSize
RtlGetControlSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetElementGenericTable
RtlGetEnabledExtendedFeatures
RtlGetExtendedContextLength
RtlGetExtendedContextLength2
RtlGetExtendedFeaturesMask
RtlGetGroupSecurityDescriptor
RtlGetNtGlobalFlags
RtlGetNtProductType
RtlGetOwnerSecurityDescriptor
RtlGetProductInfo
RtlGetSaclSecurityDescriptor
RtlGetVersion
RtlHashUnicodeString
RtlIdnToAscii
RtlIdnToNameprepUnicode
RtlIdnToUnicode
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlInitAnsiString
RtlInitAnsiStringEx
RtlInitCodePageTable
RtlInitString
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlInitializeBitMap
RtlInitializeExtendedContext
RtlInitializeExtendedContext2
RtlInitializeGenericTable
RtlInitializeGenericTableAvl
RtlInitializeSListHead
RtlInitializeSid
RtlInsertElementGenericTableAvl
RtlInt64ToUnicodeString
RtlIntegerToChar
RtlIntegerToUnicodeString
RtlInterlockedFlushSList
RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
RtlIpv4AddressToStringA
RtlIpv4AddressToStringExA
RtlIpv4AddressToStringExW
RtlIpv4AddressToStringW
RtlIpv4StringToAddressA
RtlIpv4StringToAddressExA
RtlIpv4StringToAddressExW
RtlIpv4StringToAddressW
RtlIpv6AddressToStringA
RtlIpv6AddressToStringExA
RtlIpv6AddressToStringExW
RtlIpv6AddressToStringW
RtlIpv6StringToAddressA
RtlIpv6StringToAddressExA
RtlIpv6StringToAddressExW
RtlIpv6StringToAddressW
RtlIsNameLegalDOS8Dot3
RtlIsNormalizedString
RtlLargeIntegerToChar
RtlLengthRequiredSid
RtlLengthSecurityDescriptor
RtlLengthSid
RtlLocalTimeToSystemTime
RtlLocateExtendedFeature
RtlLocateExtendedFeature2
RtlLocateLegacyContext
RtlLookupAtomInAtomTable
RtlLookupElementGenericTable
RtlMapGenericMask
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlNormalizeString
RtlNtStatusToDosError
RtlNtStatusToDosErrorNoTeb
RtlNumberGenericTableElements
RtlNumberOfClearBits
RtlNumberOfSetBits
RtlOemStringToUnicodeSize
RtlOemStringToUnicodeString
RtlOemToUnicodeN
RtlOpenCurrentUser
RtlPinAtomInAtomTable
RtlPrefixString
RtlPrefixUnicodeString
RtlQueryAtomInAtomTable
RtlQueryDepthSList
RtlQueryDynamicTimeZoneInformation
RtlQueryInformationAcl
RtlQueryPackageIdentity
RtlQueryProcessPlaceholderCompatibilityMode
RtlQueryRegistryValues
RtlQueryTimeZoneInformation
RtlRaiseStatus
RtlRandom
RtlRandomEx
RtlRemoveVectoredExceptionHandler
RtlRunOnceBeginInitialize
RtlRunOnceComplete
RtlRunOnceExecuteOnce
RtlRunOnceInitialize
RtlSecondsSince1970ToTime
RtlSecondsSince1980ToTime
RtlSelfRelativeToAbsoluteSD
RtlSetAllBits
RtlSetBits
RtlSetControlSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetExtendedFeaturesMask
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSetTimeZoneInformation
RtlSizeHeap
RtlStringFromGUID
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlSystemTimeToLocalTime
RtlTimeFieldsToTime
RtlTimeToElapsedTimeFields
RtlTimeToSecondsSince1970
RtlTimeToSecondsSince1980
RtlTimeToTimeFields
RtlUTF8ToUnicodeN
RtlUlonglongByteSwap
RtlUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemSize
RtlUnicodeStringToOemString
RtlUnicodeToCustomCPN
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnicodeToOemN
RtlUnicodeToUTF8N
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
RtlUpcaseUnicodeStringToAnsiString
RtlUpcaseUnicodeStringToCountedOemString
RtlUpcaseUnicodeStringToOemString
RtlUpcaseUnicodeToCustomCPN
RtlUpcaseUnicodeToMultiByteN
RtlUpcaseUnicodeToOemN
RtlUpperChar
RtlUpperString
RtlValidAcl
RtlValidRelativeSecurityDescriptor
RtlValidSecurityDescriptor
RtlValidSid
RtlVerifyVersionInfo
RtlWriteRegistryValue
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
vDbgPrintEx
vDbgPrintExWithPrefix
wine_server_call

Exports

Exports

CcCanIWrite
CcCopyRead
CcCopyWrite
CcDeferWrite
CcFastCopyRead
CcFastCopyWrite
CcFastMdlReadWait
CcFastReadNotPossible
CcFastReadWait
CcFlushCache
CcGetDirtyPages
CcGetFileObjectFromBcb
CcGetFileObjectFromSectionPtrs
CcGetFlushedValidData
CcGetLsnForFileObject
CcInitializeCacheMap
CcIsThereDirtyData
CcMapData
CcMdlRead
CcMdlReadComplete
CcMdlWriteAbort
CcMdlWriteComplete
CcPinMappedData
CcPinRead
CcPrepareMdlWrite
CcPreparePinWrite
CcPurgeCacheSection
CcRemapBcb
CcRepinBcb
CcScheduleReadAhead
CcSetAdditionalCacheAttributes
CcSetBcbOwnerPointer
CcSetDirtyPageThreshold
CcSetDirtyPinnedData
CcSetFileSizes
CcSetLogHandleForFile
CcSetReadAheadGranularity
CcUninitializeCacheMap
CcUnpinData
CcUnpinDataForThread
CcUnpinRepinnedBcb
CcWaitForCurrentLazyWriterActivity
CcZeroData
CmRegisterCallback
CmUnRegisterCallback
DbgBreakPoint
DbgBreakPointWithStatus
DbgLoadImageSymbols
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt
DbgQueryDebugFilterState
DbgSetDebugFilterState
ExAcquireFastMutex
ExAcquireFastMutexUnsafe
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAcquireRundownProtection
ExAcquireRundownProtectionEx
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExAllocateFromPagedLookasideList
ExAllocatePool
ExAllocatePoolWithQuota
ExAllocatePoolWithQuotaTag
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExConvertExclusiveToSharedLite
ExCreateCallback
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
ExDesktopObjectType
ExDisableResourceBoostLite
ExEnumHandleTable
ExEventObjectType
ExExtendZone
ExFreePool
ExFreePoolWithTag
ExFreeToPagedLookasideList
ExGetCurrentProcessorCounts
ExGetCurrentProcessorCpuUsage
ExGetExclusiveWaiterCount
ExGetPreviousMode
ExGetSharedWaiterCount
ExInitializeNPagedLookasideList
ExInitializePagedLookasideList
ExInitializeResourceLite
ExInitializeRundownProtection
ExInitializeZone
ExInterlockedAddLargeInteger
ExInterlockedAddLargeStatistic
ExInterlockedAddUlong
ExInterlockedCompareExchange64
ExInterlockedDecrementLong
ExInterlockedExchangeUlong
ExInterlockedExtendZone
ExInterlockedIncrementLong
ExInterlockedInsertHeadList
ExInterlockedInsertTailList
ExInterlockedPopEntryList
ExInterlockedPushEntryList
ExInterlockedRemoveHeadList
ExIsProcessorFeaturePresent
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExLocalTimeToSystemTime
ExNotifyCallback
ExQueryDepthSList
ExQueryPoolBlockSize
ExQueueWorkItem
ExRaiseAccessViolation
ExRaiseDatatypeMisalignment
ExRaiseException
ExRaiseHardError
ExRaiseStatus
ExReInitializeRundownProtection
ExRegisterCallback
ExReinitializeResourceLite
ExReleaseFastMutex
ExReleaseFastMutexUnsafe
ExReleaseResourceForThreadLite
ExReleaseResourceLite
ExReleaseRundownProtection
ExReleaseRundownProtectionEx
ExRundownCompleted
ExSemaphoreObjectType
ExSetResourceOwnerPointer
ExSetTimerResolution
ExSystemExceptionFilter
ExSystemTimeToLocalTime
ExUnregisterCallback
ExUuidCreate
ExVerifySuite
ExWaitForRundownProtectionRelease
ExWindowStationObjectType
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfInterlockedAddUlong
ExfInterlockedCompareExchange64
ExfInterlockedInsertHeadList
ExfInterlockedInsertTailList
ExfInterlockedPopEntryList
ExfInterlockedPushEntryList
ExfReleasePushLock
ExfUnblockPushLock
Exfi386InterlockedDecrementLong
Exfi386InterlockedExchangeUlong
Exfi386InterlockedIncrementLong
Exi386InterlockedDecrementLong
Exi386InterlockedExchangeUlong
Exi386InterlockedIncrementLong
ExpInterlockedFlushSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
FsRtlAcquireFileExclusive
FsRtlAddLargeMcbEntry
FsRtlAddMcbEntry
FsRtlAddToTunnelCache
FsRtlAllocateFileLock
FsRtlAllocatePool
FsRtlAllocatePoolWithQuota
FsRtlAllocatePoolWithQuotaTag
FsRtlAllocatePoolWithTag
FsRtlAllocateResource
FsRtlAreNamesEqual
FsRtlBalanceReads
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlCheckOplock
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCurrentBatchOplock
FsRtlDeleteKeyFromTunnelCache
FsRtlDeleteTunnelCache
FsRtlDeregisterUncProvider
FsRtlDissectDbcs
FsRtlDissectName
FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlFindInTunnelCache
FsRtlFreeFileLock
FsRtlGetFileSize
FsRtlGetNextFileLock
FsRtlGetNextLargeMcbEntry
FsRtlGetNextMcbEntry
FsRtlIncrementCcFastReadNoWait
FsRtlIncrementCcFastReadNotPossible
FsRtlIncrementCcFastReadResourceMiss
FsRtlIncrementCcFastReadWait
FsRtlInitializeFileLock
FsRtlInitializeLargeMcb
FsRtlInitializeMcb
FsRtlInitializeOplock
FsRtlInitializeTunnelCache
FsRtlInsertPerFileObjectContext
FsRtlInsertPerStreamContext
FsRtlIsDbcsInExpression
FsRtlIsFatDbcsLegal
FsRtlIsHpfsDbcsLegal
FsRtlIsNameInExpression
FsRtlIsNtstatusExpected
FsRtlIsPagingFile
FsRtlIsTotalDeviceFailure
FsRtlLegalAnsiCharacterArray
FsRtlLookupLargeMcbEntry
FsRtlLookupLastLargeMcbEntry
FsRtlLookupLastLargeMcbEntryAndIndex
FsRtlLookupLastMcbEntry
FsRtlLookupMcbEntry
FsRtlLookupPerFileObjectContext
FsRtlLookupPerStreamContextInternal
FsRtlMdlRead
FsRtlMdlReadComplete
FsRtlMdlReadCompleteDev
FsRtlMdlReadDev
FsRtlMdlWriteComplete
FsRtlMdlWriteCompleteDev
FsRtlNormalizeNtstatus
FsRtlNotifyChangeDirectory
FsRtlNotifyCleanup
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterReportChange
FsRtlNotifyFullChangeDirectory
FsRtlNotifyFullReportChange
FsRtlNotifyInitializeSync
FsRtlNotifyReportChange
FsRtlNotifyUninitializeSync
FsRtlNotifyVolumeEvent
FsRtlNumberOfRunsInLargeMcb
FsRtlNumberOfRunsInMcb
FsRtlOplockFsctrl
FsRtlOplockIsFastIoPossible
FsRtlPostPagingFileStackOverflow
FsRtlPostStackOverflow
FsRtlPrepareMdlWrite
FsRtlPrepareMdlWriteDev
FsRtlPrivateLock
FsRtlProcessFileLock
FsRtlRegisterFileSystemFilterCallbacks
FsRtlRegisterUncProvider
FsRtlReleaseFile
FsRtlRemoveLargeMcbEntry
FsRtlRemoveMcbEntry
FsRtlRemovePerFileObjectContext
FsRtlRemovePerStreamContext
FsRtlResetLargeMcb
FsRtlSplitLargeMcb
FsRtlSyncVolumes
FsRtlTeardownPerStreamContexts
FsRtlTruncateLargeMcb
FsRtlTruncateMcb
FsRtlUninitializeFileLock
FsRtlUninitializeLargeMcb
FsRtlUninitializeMcb
FsRtlUninitializeOplock
HalDispatchTable
HalExamineMBR
HalPrivateDispatchTable
HeadlessDispatch
InbvAcquireDisplayOwnership
InbvCheckDisplayOwnership
InbvDisplayString
InbvEnableBootDriver
InbvEnableDisplayString
InbvInstallDisplayStringFilter
InbvIsBootDriverInstalled
InbvNotifyDisplayOwnershipLost
InbvResetDisplay
InbvSetScrollRegion
InbvSetTextColor
InbvSolidColorFill
InitSafeBootMode
InitializeSListHead
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IoAcquireCancelSpinLock
IoAcquireRemoveLockEx
IoAcquireVpbSpinLock
IoAdapterObjectType
IoAllocateAdapterChannel
IoAllocateController
IoAllocateDriverObjectExtension
IoAllocateErrorLogEntry
IoAllocateIrp
IoAllocateMdl
IoAllocateWorkItem
IoAssignDriveLetters
IoAssignResources
IoAttachDevice
IoAttachDeviceByPointer
IoAttachDeviceToDeviceStack
IoAttachDeviceToDeviceStackSafe
IoBuildAsynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoBuildPartialMdl
IoBuildSynchronousFsdRequest
IoCallDriver
IoCancelFileOpen
IoCancelIrp
IoCheckDesiredAccess
IoCheckEaBufferValidity
IoCheckFunctionAccess
IoCheckQuerySetFileInformation
IoCheckQuerySetVolumeInformation
IoCheckQuotaBufferValidity
IoCheckShareAccess
IoCompleteRequest
IoConnectInterrupt
IoCreateController
IoCreateDevice
IoCreateDeviceSecure
IoCreateDisk
IoCreateDriver
IoCreateFile
IoCreateFileSpecifyDeviceObjectHint
IoCreateNotificationEvent
IoCreateStreamFileObject
IoCreateStreamFileObjectEx
IoCreateStreamFileObjectLite
IoCreateSymbolicLink
IoCreateSynchronizationEvent
IoCreateUnprotectedSymbolicLink
IoCsqInitialize
IoCsqInsertIrp
IoCsqRemoveIrp
IoCsqRemoveNextIrp
IoDeleteController
IoDeleteDevice
IoDeleteDriver
IoDeleteSymbolicLink
IoDetachDevice
IoDeviceHandlerObjectSize
IoDeviceHandlerObjectType
IoDeviceObjectType
IoDisconnectInterrupt
IoDriverObjectType
IoEnqueueIrp
IoEnumerateDeviceObjectList
IoFastQueryNetworkAttributes
IoFileObjectType
IoForwardAndCatchIrp
IoForwardIrpSynchronously
IoFreeController
IoFreeErrorLogEntry
IoFreeIrp
IoFreeMdl
IoFreeWorkItem
IoGetAttachedDevice
IoGetAttachedDeviceReference
IoGetBaseFileSystemDeviceObject
IoGetBootDiskInformation
IoGetConfigurationInformation
IoGetCurrentProcess
IoGetDeviceAttachmentBaseRef
IoGetDeviceInterfaceAlias
IoGetDeviceInterfaces
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoGetDeviceToVerify
IoGetDiskDeviceObject
IoGetDmaAdapter
IoGetDriverObjectExtension
IoGetFileObjectGenericMapping
IoGetInitialStack
IoGetLowerDeviceObject
IoGetRelatedDeviceObject
IoGetRequestorProcess
IoGetRequestorProcessId
IoGetRequestorSessionId
IoGetStackLimits
IoGetTopLevelIrp
IoInitializeIrp
IoInitializeRemoveLockEx
IoInitializeTimer
IoInvalidateDeviceRelations
IoInvalidateDeviceState
IoIs32bitProcess
IoIsFileOriginRemote
IoIsOperationSynchronous
IoIsSystemThread
IoIsValidNameGraftingBuffer
IoIsWdmVersionAvailable
IoMakeAssociatedIrp
IoOpenDeviceInterfaceRegistryKey
IoOpenDeviceRegistryKey
IoPageRead
IoPnPDeliverServicePowerNotification
IoQueryDeviceDescription
IoQueryFileDosDeviceName
IoQueryFileInformation
IoQueryVolumeInformation
IoQueueThreadIrp
IoQueueWorkItem
IoRaiseHardError
IoRaiseInformationalHardError
IoReadDiskSignature
IoReadOperationCount
IoReadPartitionTable
IoReadPartitionTableEx
IoReadTransferCount
IoRegisterBootDriverReinitialization
IoRegisterDeviceInterface
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoRegisterFsRegistrationChange
IoRegisterLastChanceShutdownNotification
IoRegisterPlugPlayNotification
IoRegisterShutdownNotification
IoReleaseCancelSpinLock
IoReleaseRemoveLockAndWaitEx
IoReleaseRemoveLockEx
IoReleaseVpbSpinLock
IoRemoveShareAccess
IoReportDetectedDevice
IoReportHalResourceUsage
IoReportResourceForDetection
IoReportResourceUsage
IoReportTargetDeviceChange
IoReportTargetDeviceChangeAsynchronous
IoRequestDeviceEject
IoReuseIrp
IoSetCompletionRoutineEx
IoSetDeviceInterfaceState
IoSetDevicePropertyData
IoSetDeviceToVerify
IoSetFileOrigin
IoSetHardErrorOrVerifyDevice
IoSetInformation
IoSetIoCompletion
IoSetPartitionInformation
IoSetPartitionInformationEx
IoSetShareAccess
IoSetStartIoAttributes
IoSetSystemPartition
IoSetThreadHardErrorMode
IoSetTopLevelIrp
IoStartNextPacket
IoStartNextPacketByKey
IoStartPacket
IoStartTimer
IoStatisticsLock
IoStopTimer
IoSynchronousInvalidateDeviceRelations
IoSynchronousPageWrite
IoThreadToProcess
IoUnregisterFileSystem
IoUnregisterFsRegistrationChange
IoUnregisterPlugPlayNotification
IoUnregisterShutdownNotification
IoUpdateShareAccess
IoValidateDeviceIoControlAccess
IoVerifyPartitionTable
IoVerifyVolume
IoVolumeDeviceToDosName
IoWMIAllocateInstanceIds
IoWMIDeviceObjectToInstanceName
IoWMIExecuteMethod
IoWMIHandleToInstanceName
IoWMIOpenBlock
IoWMIQueryAllData
IoWMIQueryAllDataMultiple
IoWMIQuerySingleInstance
IoWMIQuerySingleInstanceMultiple
IoWMIRegistrationControl
IoWMISetNotificationCallback
IoWMISetSingleInstance
IoWMISetSingleItem
IoWMISuggestInstanceName
IoWMIWriteEvent
IoWriteErrorLogEntry
IoWriteOperationCount
IoWritePartitionTable
IoWritePartitionTableEx
IoWriteTransferCount
IofCallDriver
IofCompleteRequest
KdDebuggerEnabled
KdDebuggerNotPresent
KdDisableDebugger
KdEnableDebugger
KdEnteredDebugger
KdPollBreakIn
KdPowerTransition
KdRefreshDebuggerNotPresent
Ke386CallBios
Ke386IoSetAccessProcess
Ke386QueryIoAccessMap
Ke386SetIoAccessMap
KeAcquireInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel

Sections

.text
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 416KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

940e2d04bf78ff4a05c8ccf3759f1bcb

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 148KB

.data Size: 4KB - Virtual size: 1KB

.rodata Size: 24KB - Virtual size: 23KB

.rdata Size: 24KB - Virtual size: 20KB

.pdata Size: 8KB - Virtual size: 4KB

.xdata Size: 8KB - Virtual size: 4KB

.bss Size: - Virtual size: 1KB

.edata Size: 96KB - Virtual size: 93KB

.idata Size: 28KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 4KB - Virtual size: 324B

/4 Size: 4KB - Virtual size: 576B

/19 Size: 416KB - Virtual size: 412KB

/31 Size: 16KB - Virtual size: 13KB

/45 Size: 92KB - Virtual size: 88KB

/57 Size: 32KB - Virtual size: 31KB

/70 Size: 24KB - Virtual size: 22KB

/81 Size: 256KB - Virtual size: 252KB

/92 Size: 44KB - Virtual size: 41KB

.text
Size: 152KB - Virtual size: 148KB

.data
Size: 4KB - Virtual size: 1KB

.rodata
Size: 24KB - Virtual size: 23KB

.rdata
Size: 24KB - Virtual size: 20KB

.pdata
Size: 8KB - Virtual size: 4KB

.xdata
Size: 8KB - Virtual size: 4KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 96KB - Virtual size: 93KB

.idata
Size: 28KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 4KB - Virtual size: 324B

/4
Size: 4KB - Virtual size: 576B

/19
Size: 416KB - Virtual size: 412KB

/31
Size: 16KB - Virtual size: 13KB

/45
Size: 92KB - Virtual size: 88KB

/57
Size: 32KB - Virtual size: 31KB

/70
Size: 24KB - Virtual size: 22KB

/81
Size: 256KB - Virtual size: 252KB

/92
Size: 44KB - Virtual size: 41KB