bdeec4302fe5a88623a089722facf9906749d14e1e8eb8122e55f0530704c3cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bdeec4302fe5a88623a089722facf9906749d14e1e8eb8122e55f0530704c3cd
Size

49KB
MD5

148d79923328b1edd40bcbfbb41e5a00
SHA1

f4794465cf1cd8a4ca1e413d41ddf549b573542f
SHA256

bdeec4302fe5a88623a089722facf9906749d14e1e8eb8122e55f0530704c3cd
SHA512

1a4779e6ad2444e4b0f386cae8019b89b15847e6049eea8a3e742b8071960bce0b63758ed45aa04d139e2dca65bc6e14aadd0051b26d59ca086dcabe8ee1fb81
SSDEEP

1536:bKSVbunmcjo/fNK0B4jGsGSu8ti22YLWcM5V8T9:bKSNumcEH/IL

Score

N/A

Malware Config

Signatures

Files

bdeec4302fe5a88623a089722facf9906749d14e1e8eb8122e55f0530704c3cd
.exe windows x86

833eb1be48e090c8bc93eecb503d5837

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
ZwClose
ZwUnmapViewOfSection
swprintf
MmGetSystemRoutineAddress
RtlInitUnicodeString
PsSetCreateProcessNotifyRoutine
wcscat
wcscpy
ZwCreateFile
IoRegisterDriverReinitialization
PsGetVersion
_wcslwr
wcsncpy
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
KeDelayExecutionThread
ZwCreateKey
RtlAnsiStringToUnicodeString
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 900B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 736B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ