635b531da2668610cce8a58e5c29999be3eb158b407e399ebd0dd82105203a0f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

635b531da2668610cce8a58e5c29999be3eb158b407e399ebd0dd82105203a0f
Size

31KB
MD5

2194ad2228e4102ebaffb3fd3a87f0e7
SHA1

78a49c62318c9b0efae0c64bc5873b7e3a6d5686
SHA256

635b531da2668610cce8a58e5c29999be3eb158b407e399ebd0dd82105203a0f
SHA512

681b39aafb40ada8cecf8706cfad55c9db04561ffdd23d1fea0184f95443c0d97fece1d59322a90f52b300f41113711bc004440a5a38f82e083236b10f1a5878
SSDEEP

384:ZlNclfRevYnSDHXbou5HWuDRjX33Svp36Yg3nVMpdHrBgWCAviet8c0v:gEYnSDHXlHTRmRqYg3nQhp5viW9

Score

N/A

Malware Config

Signatures

Files

635b531da2668610cce8a58e5c29999be3eb158b407e399ebd0dd82105203a0f
.exe windows x86

7b7a85ee22ec2a7b46aa56030277fbbe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwMapViewOfSection
ZwCreateSection
RtlInitUnicodeString
_wcsnicmp
wcslen
swprintf
wcscat
wcscpy
_stricmp
strncpy
_except_handler3
ExFreePool
ExAllocatePoolWithTag
ZwUnmapViewOfSection
MmGetSystemRoutineAddress
PsGetVersion
strncmp
_strnicmp
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
_snprintf

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 576B - Virtual size: 550B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ