223da2049e7554fa60c080cef1f1aef9ee1d3cc81ab5fe647932f8a145f21895 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

223da2049e7554fa60c080cef1f1aef9ee1d3cc81ab5fe647932f8a145f21895
Size

21KB
MD5

55a0bb2fbe666baff8ba304f817e9310
SHA1

ee70b4150851756c2f1d8588f9f86258e8161686
SHA256

223da2049e7554fa60c080cef1f1aef9ee1d3cc81ab5fe647932f8a145f21895
SHA512

0172640589bdeb377f132ff7aea4c1258c0e9316ef5b3c873cdb4a3fb5bd4db80fbaa26b86c7987959a68f3dd531066744a20ce22fddf199c9840b0798f66c43
SSDEEP

384:Dbn4zCIlJNeEMSKolpP7ViT+Jrg20Voewo+u0jCp4Luo1vaqpm3CvW:Db4zCOJNeEMSKolpP78HWe+FcIDvJpm3

Score

N/A

Malware Config

Signatures

Files

223da2049e7554fa60c080cef1f1aef9ee1d3cc81ab5fe647932f8a145f21895
.exe windows x86

2297553c2be1e462b6220d901cde88ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeDelayExecutionThread
ZwClose
ZwCreateKey
wcslen
swprintf
RtlInitUnicodeString
wcscat
wcscpy
strncmp
IoGetCurrentProcess
_wcsnicmp
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwCreateFile
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsGetVersion
_wcslwr
wcsncpy
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmIsAddressValid
ZwUnmapViewOfSection

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 576B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ