5fc5615b027e61b0e5f5b6af59217c75db61bf3bf0d0ece0d918d3a564020c59 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5fc5615b027e61b0e5f5b6af59217c75db61bf3bf0d0ece0d918d3a564020c59
Size

25KB
MD5

6ac1d6fcbd0ba41ea5cec2f5c531afa0
SHA1

47cfb876837f6cea98b728a2405c7f264357d3b5
SHA256

5fc5615b027e61b0e5f5b6af59217c75db61bf3bf0d0ece0d918d3a564020c59
SHA512

d68bfc44b4b22619788094dd86d253da0b25a6c224b127ee1023b7614736039b3acc8bf2ac21b89c559dcef1f7229a542a2e52093d85695052fa99045d94fdd3
SSDEEP

384:j/OoRTuxEoypv63+xMefC8BxOoXSNIFO3WKPYoj/g5:jbRTiEofgfC8vO/NIFO3WxCg

Score

N/A

Malware Config

Signatures

Files

5fc5615b027e61b0e5f5b6af59217c75db61bf3bf0d0ece0d918d3a564020c59
.exe windows x86

0fbdb5363208100aa04a609c4c71a804

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
RtlInitUnicodeString
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
wcscat
wcscpy
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
PsGetVersion
_wcslwr
wcsncpy
MmIsAddressValid
ZwCreateKey
wcslen
swprintf
ZwUnmapViewOfSection
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlAnsiStringToUnicodeString
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwCreateFile
IoRegisterDriverReinitialization
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ