37691ba1a02530e17a75996b334bfe9535abe2ba8a8dfab5587ec074e29b3fac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37691ba1a02530e17a75996b334bfe9535abe2ba8a8dfab5587ec074e29b3fac
Size

48KB
MD5

70a9a53139c9d64c09cfe2eb2126c110
SHA1

c91185890833500c59b8acccae390b591811eb85
SHA256

37691ba1a02530e17a75996b334bfe9535abe2ba8a8dfab5587ec074e29b3fac
SHA512

298e68e30af0772218e3709def8d81672855af03602ba07efb8bcf3955dc3edf8bd7914502626f87c07772415d078a8730147eea7f37d8522cb3078197271850
SSDEEP

1536:xyLXFdTUYWkOk0lpKVoLraptto0pt6yt:xy7FdTUYWlk0lpKVoLeptto0pt6y

Score

N/A

Malware Config

Signatures

Files

37691ba1a02530e17a75996b334bfe9535abe2ba8a8dfab5587ec074e29b3fac
.exe windows x86

8c2ca68b4e9c3c64eb673a5cd09555d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
wcscat
wcscpy
swprintf
MmGetSystemRoutineAddress
ZwUnmapViewOfSection
RtlAnsiStringToUnicodeString
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
ZwCreateKey
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
PsGetVersion
_wcslwr
wcsncpy

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 900B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 736B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ