b4e376379b6573e909f4327e03e50575d365c85e316edc9b3ab58e3f56e3b8b3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4e376379b6573e909f4327e03e50575d365c85e316edc9b3ab58e3f56e3b8b3
Size

157KB
MD5

6bf8decf9b216ae596378f1f06af4480
SHA1

83d46ac6d32b630d51f474e2778298bc4bda0698
SHA256

b4e376379b6573e909f4327e03e50575d365c85e316edc9b3ab58e3f56e3b8b3
SHA512

04a70f89ee3346e89f1c972f7ef483b4661bcf1a13e9d1a24e22c5a4d39ec348c4ff75becb0f19ad36c6cf0db4272bbdab5d5e7b087ce6cc39701860130188b9
SSDEEP

3072:EUcbafxmo4MHcec2peszqDo44OOg+aOVsWNTHqpW7zhf7rWj5wC9isS/VBKFC5oB:EUBbYT++W7zhPofCyJbfI2

Score

N/A

Malware Config

Signatures

Files

b4e376379b6573e909f4327e03e50575d365c85e316edc9b3ab58e3f56e3b8b3
.exe windows x86

6c1c47250f04345270a283e47b3fc4e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlPrefixUnicodeString
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlEqualUnicodeString
NtQueryDirectoryObject
NtOpenDirectoryObject
RtlInitUnicodeString
wcslen
NtSetInformationFile
wcscpy
NtOpenFile
wcsncpy
RtlFreeHeap
NtSetValueKey
wcsstr
_wcslwr
RtlAllocateHeap
NtQueryValueKey
NtOpenKey
RtlOemToUnicodeN
NtReadFile
NtQueryInformationFile
NtCreateFile
wcschr
qsort
RtlReAllocateHeap
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlUnwind
NtQueryVirtualMemory
DbgBreakPoint
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ