37da83a8d97a700d1e6a369ecf601dc75acead7eedad0333d0a7b46d9b3cc4e5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37da83a8d97a700d1e6a369ecf601dc75acead7eedad0333d0a7b46d9b3cc4e5
Size

48KB
MD5

6bff7bf6df9344ee30ca634aef83d6f0
SHA1

d6b9fabfd28b0b301a8df2e54b054e534e70a277
SHA256

37da83a8d97a700d1e6a369ecf601dc75acead7eedad0333d0a7b46d9b3cc4e5
SHA512

5973c45ff1d30ac65d07c615e2faaf54a8c11db43fea8470ad080a4df5313b4d2a974883006f5ec70038f5c31b8991ecd7629442b20845f25f4d50a36fe967a3
SSDEEP

768:RzFhhPJCW7nCAPvls4VkSE7z24gzrzSLQF64UcKF:Rhh7C6fNstbz24gzrzSQF6x

Score

N/A

Malware Config

Signatures

Files

37da83a8d97a700d1e6a369ecf601dc75acead7eedad0333d0a7b46d9b3cc4e5
.exe windows x86

d020de1b97ea3330beaa7f1edf65bf8e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strlen
ZwClose
ZwWriteFile
ZwCreateFile
RtlInitUnicodeString
strncmp
PsGetProcessImageFileName
PsLookupProcessByProcessId
ZwSetValueKey
ZwCreateKey
memset
ExAllocatePoolWithTag
memcpy
KeReleaseMutex
RtlEqualUnicodeString
KeWaitForSingleObject
_except_handler3
ExFreePoolWithTag
RtlFreeUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
ObQueryNameString
ObfDereferenceObject
ObReferenceObjectByHandle
MmIsAddressValid
RtlAppendUnicodeStringToString
ZwOpenFile
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
KeInitializeMutex

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 800B - Virtual size: 792B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 480B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ