7aa6f2fabc0fce736fad039848c53df090a0b7b30f3d287a99bdb59c2e085700 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7aa6f2fabc0fce736fad039848c53df090a0b7b30f3d287a99bdb59c2e085700
Size

70KB
MD5

6a0a7f6da66d4d1871052c1af69fc5f7
SHA1

57140a3e6417338fa7c5392fbc9a333ad18a7d24
SHA256

7aa6f2fabc0fce736fad039848c53df090a0b7b30f3d287a99bdb59c2e085700
SHA512

8c1342b783c860a2e0010de5e24f76fff816535e3eb7c87d38a3b4ce0e3884ea2b3ee96fb9bc90afb856d225927bfd78ea1c36901256763a2eccdd21870e1373
SSDEEP

1536:hZgOjI6VGsHNh+WZEbz1b4G41h6neoRXI0gxMmmGHFHaXByaQ/r:hMpsWWZIz1cG41hYTXIuGlHaxya

Score

N/A

Malware Config

Signatures

Files

7aa6f2fabc0fce736fad039848c53df090a0b7b30f3d287a99bdb59c2e085700
.dll windows x86

6466509cd0f274892f56500322cc6895

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoBuildPartialMdl
RtlUnicodeToOemN
KeRegisterBugCheckCallback
KeQueryTimeIncrement
RtlEqualUnicodeString
RtlSetBits
RtlCharToInteger
ExRaiseStatus
RtlUpcaseUnicodeChar
ZwOpenFile
KeInitializeEvent
RtlInitString
CcIsThereDirtyData
CcPreparePinWrite
RtlUpperChar
KeRundownQueue
PsSetLoadImageNotifyRoutine
ExGetSharedWaiterCount
PsIsThreadTerminating
FsRtlLookupLastLargeMcbEntry
RtlInitUnicodeString
RtlEqualString
RtlInt64ToUnicodeString
FsRtlIsNameInExpression
RtlInitializeGenericTable
RtlRandom
KeStackAttachProcess
IoDisconnectInterrupt

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 748B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ