517ce27c7f84f00fd51b2f16ddd48e2932b3459f62a3538a4d09d774ea71d384 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

517ce27c7f84f00fd51b2f16ddd48e2932b3459f62a3538a4d09d774ea71d384
Size

21KB
MD5

6d7ce5d660aac41d53fffada9e438430
SHA1

04b906da09ef5d13ecfede9c410c085ace21d44a
SHA256

517ce27c7f84f00fd51b2f16ddd48e2932b3459f62a3538a4d09d774ea71d384
SHA512

ed7bb773a514e035207531a9553e1a050670a9eb6065928962cef86f7c97a1444b2c54be1b7064fef4aabaee6565c796ed5b597e93181b6d337a97a438323bd0
SSDEEP

384:+hPoWIPIxYBex1JBlaWmWJDhzsnNDPBo5BXUTLNn4:+bbJ+T8u

Score

N/A

Malware Config

Signatures

Files

517ce27c7f84f00fd51b2f16ddd48e2932b3459f62a3538a4d09d774ea71d384
.exe windows x86

6b43fb6048cc0b5d3016a26beb061fdc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
KeServiceDescriptorTable
ZwWriteFile
ZwTerminateProcess
ZwSetValueKey
ZwReadFile
ZwQueryInformationProcess
ZwQueryInformationFile
ZwQueryDirectoryFile
ZwOpenThread
ZwOpenProcess
ZwDeleteFile
ZwCreateKey
ZwCreateFile
ZwClose
ZwAllocateVirtualMemory
RtlCompareUnicodeString
NtLockFile
_strnicmp
PsLookupProcessByProcessId

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 768B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 608B - Virtual size: 606B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ