ce6ed4889bb3370a13855c8fb782795801b488dcd23c9cbd532d17f2d47c9eb3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce6ed4889bb3370a13855c8fb782795801b488dcd23c9cbd532d17f2d47c9eb3
Size

8KB
MD5

00c3c4c1f07d033e7a4d2ec0a632c44f
SHA1

43acf7ed12957ab375e3db00c716a43e3f1abe21
SHA256

ce6ed4889bb3370a13855c8fb782795801b488dcd23c9cbd532d17f2d47c9eb3
SHA512

6c6e2dbc14635afab6f3fb154f319933dfb589c541f22ac08a2f9c096c5c0c8b548c1810fb05dec54acb018be848192b69bf3be91fb19d3e8285e7cfcc231365
SSDEEP

192:TowhTkKoybGgqR4DLaHTMf+4ITZowfe1Lu:9hzbGg9XJm4uRGJu

Score

N/A

Malware Config

Signatures

Files

ce6ed4889bb3370a13855c8fb782795801b488dcd23c9cbd532d17f2d47c9eb3
.exe windows x86

b7a9ada452380dbef2c10f17db0ca25c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
_except_handler3
IoCreateFile
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IofCompleteRequest
ZwClose
KeServiceDescriptorTable
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
wcslen

hal

KeGetCurrentIrql

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 890B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ