50a7fef9b461d8c79f9f93a62b954e4be99c2d6cfbde96a02c03f2454de6a1e1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

50a7fef9b461d8c79f9f93a62b954e4be99c2d6cfbde96a02c03f2454de6a1e1
Size

23KB
MD5

0ab6df3fb0c69ccb03b855c593ef071b
SHA1

db0579b57d73f9f0653f7519b03feaec0742c66b
SHA256

50a7fef9b461d8c79f9f93a62b954e4be99c2d6cfbde96a02c03f2454de6a1e1
SHA512

5087ac906e152f2e9de38e72bea566d91bd0cdee2bfec56f4f33c7cdba54b317d74528c28b102f99b4c37672610b77a32a0fb9db060ac93b805a18a4135dc22f
SSDEEP

384:OQh6lNa/qJbNB4QdLGq2/IiamG3NGWJIIY/Z/kiUvQhSA91KyTqfWlv1TL40eROV:vyaOplkQU6IIYZVyqex

Score

N/A

Malware Config

Signatures

Files

50a7fef9b461d8c79f9f93a62b954e4be99c2d6cfbde96a02c03f2454de6a1e1
.exe windows x86

e77cf83c1d2dadce1723bb783450a0c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwCreateFile
ZwEnumerateKey
ZwSetValueKey
ZwClose
ZwOpenKey
MmIsAddressValid
RtlInitUnicodeString
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
ZwUnmapViewOfSection
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
PsGetVersion
_wcslwr
wcsncpy
strncmp
IoGetCurrentProcess
_wcsnicmp
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ