bfdef06c8c54290f42306d970543af5064b6081058b38b418e4fb4226e32fc33 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bfdef06c8c54290f42306d970543af5064b6081058b38b418e4fb4226e32fc33
Size

445KB
MD5

788cc811d2a51a622c114b3cda7546b9
SHA1

5d8f6160f82ba2d233c56321c755f7e9cc8585ca
SHA256

bfdef06c8c54290f42306d970543af5064b6081058b38b418e4fb4226e32fc33
SHA512

9660a9cce55611936193869bde2c05a941d6236b78ea3638682251c824a44628bf51485ce8b0f0ae86679325a01303848b341b41e7062497ae20f092a4aea49d
SSDEEP

12288:bM41/uGP/BtKy4LE4wxubJ2Li73ZpjgRdKWQ:bM4EqiW/MbJ2LO3ZpkRIx

Score

N/A

Malware Config

Signatures

Files

bfdef06c8c54290f42306d970543af5064b6081058b38b418e4fb4226e32fc33
.dll windows x86

6466509cd0f274892f56500322cc6895

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoBuildPartialMdl
RtlUnicodeToOemN
KeRegisterBugCheckCallback
KeQueryTimeIncrement
RtlEqualUnicodeString
RtlSetBits
RtlCharToInteger
ExRaiseStatus
RtlUpcaseUnicodeChar
ZwOpenFile
KeInitializeEvent
RtlInitString
CcIsThereDirtyData
CcPreparePinWrite
RtlUpperChar
KeRundownQueue
PsSetLoadImageNotifyRoutine
ExGetSharedWaiterCount
PsIsThreadTerminating
FsRtlLookupLastLargeMcbEntry
RtlInitUnicodeString
RtlEqualString
RtlInt64ToUnicodeString
FsRtlIsNameInExpression
RtlInitializeGenericTable
RtlRandom
KeStackAttachProcess
IoDisconnectInterrupt

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ