bcfc9d2f9d20f05ed554b9c0b7926e575adc16a897091f4c4d8de99fb0d34328 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bcfc9d2f9d20f05ed554b9c0b7926e575adc16a897091f4c4d8de99fb0d34328
Size

23KB
MD5

6073ebad4cab6cd89e80887ac384e1f3
SHA1

aba4e35c2d227c2436579d81da66f5d223c0a24c
SHA256

bcfc9d2f9d20f05ed554b9c0b7926e575adc16a897091f4c4d8de99fb0d34328
SHA512

3127d35312ff4049389605cfdb4e50eb42b564215dc2383eafd424c2bcc2ebf3920327b4dc6d94a739a0536c25d6bda67098b5289471983c0f6beab86e428fef
SSDEEP

384:wlWD46iSk+4CHFmP1k0BOkC5ztiQJqSvG7gORU31Ck38:wkG9wKeD14OkkM

Score

N/A

Malware Config

Signatures

Files

bcfc9d2f9d20f05ed554b9c0b7926e575adc16a897091f4c4d8de99fb0d34328
.exe windows x86

4c0fb7d9e224f297ce7a22f2692256da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
ZwClose
IofCompleteRequest
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
swprintf
RtlInitUnicodeString
_except_handler3
MmGetSystemRoutineAddress
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
wcscpy
wcscat
strncpy
ZwUnmapViewOfSection
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
RtlAnsiStringToUnicodeString
_stricmp
_strnicmp
RtlCompareUnicodeString
PsGetVersion
MmIsAddressValid

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 736B - Virtual size: 720B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 992B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ