c093d28e62c87d91a02831e1a3e1d68c2fd535bb47a6d5299852cefadb2265bd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c093d28e62c87d91a02831e1a3e1d68c2fd535bb47a6d5299852cefadb2265bd
Size

6KB
MD5

67f6d4844e827a7390f3e889fa6464f0
SHA1

7f8f83ff253cc925337ca53e6a895021cccaf889
SHA256

c093d28e62c87d91a02831e1a3e1d68c2fd535bb47a6d5299852cefadb2265bd
SHA512

9fc604266e0ee4485c50d6ad8aab5f5ce1152c77a25e1b169421f91c4b0361a7abff19514caef19e5c7f61a3b63bb701ee075539ab658656788dfbc5d40a550e
SSDEEP

96:A2qm4MwvF4vtFzwS4Xj9fe6B/Y5ISJ1oFUUgU9TlIZOZ+9SUAKtMzqUCxt:B4MVtF8nGISJ1Q9gU1lTA9LAMt

Score

N/A

Malware Config

Signatures

Files

c093d28e62c87d91a02831e1a3e1d68c2fd535bb47a6d5299852cefadb2265bd
.exe windows x86

bb987107c12db4043bce620809ac5191

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
ObOpenObjectByPointer
_except_handler3
IoCreateFile
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmUnmapViewOfSection
ZwClose
ZwSetValueKey
wcslen
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwCreateKey
RtlInitAnsiString
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IofCompleteRequest
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
PsLookupProcessByProcessId

hal

KeGetCurrentIrql

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 354B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ