02f701b289b4a67a6441661832750bd8c4f3aa47a5dde9eaac67b89af322b9d9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02f701b289b4a67a6441661832750bd8c4f3aa47a5dde9eaac67b89af322b9d9
Size

17KB
MD5

4f906edb1379a8500071b66055cae97c
SHA1

726dc736901fdb66658c55264c7fd0e2a2e49ccb
SHA256

02f701b289b4a67a6441661832750bd8c4f3aa47a5dde9eaac67b89af322b9d9
SHA512

012ccdc1e9df0da29ad9ec1f55dd14d28fa42b31e208cfa0ec5dab387b6c4da2d7ddf41c2a1f624424591a38c39f8cdc20d95b20b1ad2ed656478a746337b7fd
SSDEEP

192:83FsqM0SatkVC3H8IcDR8msqNTuol9f1rVqo5KDorVqo5KDHqkoaneLcxOIfn:lutkVuH8IcDRpViol9f1pnRpn90aAOI

Score

N/A

Malware Config

Signatures

Files

02f701b289b4a67a6441661832750bd8c4f3aa47a5dde9eaac67b89af322b9d9
.exe windows x86

379ab6aef73dd5df6c3f8ccee0bd70b6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strlen
ZwClose
ExFreePool
ZwWriteFile
strcat
memset
ExAllocatePoolWithTag
ZwCreateFile
RtlInitUnicodeString
strncmp
IoGetCurrentProcess
_except_handler3
RtlFreeUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
_snwprintf
ZwEnumerateKey
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
_wcsnicmp
wcslen
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 974B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ