0db9b580505bfe9a6a86a6d4ca776ee446ce032ae6c80ffd14ab2d1efd7f7001 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0db9b580505bfe9a6a86a6d4ca776ee446ce032ae6c80ffd14ab2d1efd7f7001
Size

443KB
MD5

78a00613b9aa7aab3dd27e3a03ffbb5d
SHA1

faf0573246d2119315e4fbf65f35ad4fc3bd3f5f
SHA256

0db9b580505bfe9a6a86a6d4ca776ee446ce032ae6c80ffd14ab2d1efd7f7001
SHA512

43d7eaa698c3f926cde9904ef46649e320ca283326f5a1a5401b3a06c70803915bc90e932c9a29a435447b04e43dda156a3f76c1b108ad222a28e45f3f07671b
SSDEEP

6144:YOqmgI0VhSVHIrMbA96Vid9szw77k6M8i1cES128JV3Lk1q13+pKSSFxi8d0Q7ke:YZnhGHkJs0MO128JtpuY9ccSI8tAZH

Score

N/A

Malware Config

Signatures

Files

0db9b580505bfe9a6a86a6d4ca776ee446ce032ae6c80ffd14ab2d1efd7f7001
.dll windows x86

729486717a861a9970a736a3dbe89b6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlCompareString
ZwQueryValueKey
IoStopTimer
CcZeroData
IoAcquireCancelSpinLock
FsRtlGetNextFileLock
RtlCopyUnicodeString
RtlIntegerToUnicodeString
PoSetSystemState
RtlCopyString
CcCopyRead
RtlEqualString
IoGetStackLimits
RtlUnicodeToMultiByteN
KeReadStateEvent
RtlInitString
RtlEqualUnicodeString
ExRaiseStatus
RtlCharToInteger
PsSetLoadImageNotifyRoutine
FsRtlFastCheckLockForRead
KeCancelTimer
strncpy
RtlxAnsiStringToUnicodeSize
RtlInitUnicodeString
IoDeleteSymbolicLink
KeInitializeTimerEx

Sections

.text
Size: 23KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ