3a743b64df7832a9b762123cc65a615aac56949d1565e1c614df4141bcbe3c96 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a743b64df7832a9b762123cc65a615aac56949d1565e1c614df4141bcbe3c96
Size

56KB
MD5

ddbdae7cae028b62e9509342ba3167b2
SHA1

49053c3939b4fa7bf27bfa5380b43338a413b439
SHA256

3a743b64df7832a9b762123cc65a615aac56949d1565e1c614df4141bcbe3c96
SHA512

3b47df6cbd6eb9b9109848a1f7ce72460709be996520ec7afdb65e038a79ab7fd695cb0b925e057e5d6566d70fa14c7662ad9d487133e635d2ef65d91ef8d343
SSDEEP

1536:t6Q2+urm9UEIisNKRyvCpvTlkPEXejn6Q2+urm9UEIisNKRyvCpvTlkPEXejh:AEurmKisNIyv+ZkcXe+EurmKisNIyv+s

Score

N/A

Malware Config

Signatures

Files

3a743b64df7832a9b762123cc65a615aac56949d1565e1c614df4141bcbe3c96
.exe windows x86

e309f64423e2649c48a77312620df8ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

swprintf
RtlCopyUnicodeString
RtlInitUnicodeString
_stricmp
strncpy
wcslen
wcscat
wcscpy
_strnicmp
ZwClose
ZwOpenKey
RtlAnsiStringToUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
ObfDereferenceObject
strncmp
MmGetSystemRoutineAddress
IofCompleteRequest
_wcsnicmp

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 834B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ