4ec1234f3a692760e14100422cab3ae7c76cca53c20cd959dcb4aa3b389abee9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4ec1234f3a692760e14100422cab3ae7c76cca53c20cd959dcb4aa3b389abee9
Size

28KB
MD5

68f8d26ac5519184da75fcde6a6e2a74
SHA1

02056da7e5e6d2eb13c9c257edf30040e7dbe082
SHA256

4ec1234f3a692760e14100422cab3ae7c76cca53c20cd959dcb4aa3b389abee9
SHA512

8db33f49015830f61e86c7de972f99b79519edbe2fee10db289ca503acb054e0477835e112bb17da735ec80305c1f6e2e484abf218737e5a095b89c68e3f0156
SSDEEP

768:qNBscfxwDYpfa7lI5gZfqkUR9OhjplCjekLD1MnO:qNecfxweS7lIaZf9UDEwScZs

Score

N/A

Malware Config

Signatures

Files

4ec1234f3a692760e14100422cab3ae7c76cca53c20cd959dcb4aa3b389abee9
.exe windows x86

a3f017ecee49b52c29ba8bc1cb38e37d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

swprintf
RtlInitUnicodeString
strncmp
wcslen
wcscat
wcscpy
_strnicmp
MmGetSystemRoutineAddress
strncpy
ObfDereferenceObject
_stricmp
RtlAnsiStringToUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwClose
ZwOpenKey
_wcsnicmp
RtlCopyUnicodeString

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 800B - Virtual size: 780B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ