dafd35d4f10d5b881efb2e044afa3a836dc06985126fe120d066b0d8307412ba | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dafd35d4f10d5b881efb2e044afa3a836dc06985126fe120d066b0d8307412ba
Size

18KB
MD5

006e2f3ac9ac7b531c5927b6baf9f592
SHA1

2078a5ed647c30e92540dfb385fcf3a480ccc881
SHA256

dafd35d4f10d5b881efb2e044afa3a836dc06985126fe120d066b0d8307412ba
SHA512

a2b82b7b787e69949e9a1a5c7820fb5167117ac9ac51933ae679d3b7ff38d98b7a9882a77ae42eeef4db5b328bf99b2ec07e3de0f7640faad31adda70d52991a
SSDEEP

384:8udfVyjS6tVCujeJBAjMHsIpiKnE4T7pYF4u3UVaDwBt3oZSbMtGPSxIOkCWhF/P:tMWsIpiKE4T7pYF4u3UVaDwBt3oZSbM+

Score

N/A

Malware Config

Signatures

Files

dafd35d4f10d5b881efb2e044afa3a836dc06985126fe120d066b0d8307412ba
.exe windows x86

7c82d5ed32907ab6c262d1ae4167dae6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strlen
ZwClose
ExFreePool
ZwWriteFile
strcat
memset
ExAllocatePoolWithTag
ZwCreateFile
RtlInitUnicodeString
_stricmp
strncmp
IoGetCurrentProcess
_except_handler3
ZwSetValueKey
strstr
ZwQueryValueKey
ZwCreateKey
wcscat
wcscpy
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
_snwprintf
ZwEnumerateKey
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
_wcsnicmp
wcslen
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ