fe033ac5b38d6568df9ad2106947c8e6f705095437bdea51e38860e4978597ce | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe033ac5b38d6568df9ad2106947c8e6f705095437bdea51e38860e4978597ce
Size

28KB
MD5

4334bce9ff020ad55857a875f00fac40
SHA1

8d35fd761f050f5f0973f50f355142746e241636
SHA256

fe033ac5b38d6568df9ad2106947c8e6f705095437bdea51e38860e4978597ce
SHA512

392c162cd3e4ee872544b71f07ca1ce489198e4b46233f1295477e606877e84dc04f4b73d31aa998746b199bb26c810ed9e43754b1d4a2d4d0b22253f5e9c4d1
SSDEEP

768:bEalpLe7S1/H9Z+Q1TYC7hw1ib3IX5q+nIaqstVu5BUw/Te:bpLeGB9ZHlYC7hb3H+IazVu5BUw

Score

N/A

Malware Config

Signatures

Files

fe033ac5b38d6568df9ad2106947c8e6f705095437bdea51e38860e4978597ce
.exe windows x86

b4ef07979b80b803043d90ad9800e764

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcscat
wcscpy
_itow
ZwClose
RtlInitUnicodeString
ZwOpenKey
RtlCopyUnicodeString
_strnicmp
MmGetSystemRoutineAddress
wcslen
strncmp
_stricmp
strncpy
_except_handler3
RtlAnsiStringToUnicodeString
ObfDereferenceObject
swprintf
ExFreePool
_snprintf
ExAllocatePoolWithTag
IofCompleteRequest
_wcsnicmp

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 910B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ