3a2e3763fdf62c6b35fa139183191696e5b5d6c9a89707bdbe7f45df8238ff5c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a2e3763fdf62c6b35fa139183191696e5b5d6c9a89707bdbe7f45df8238ff5c
Size

9KB
MD5

7ab40e3a8e78421c56115afaf6fb429e
SHA1

13ec53eb71a47626c475d53c732ee67fe8110e49
SHA256

3a2e3763fdf62c6b35fa139183191696e5b5d6c9a89707bdbe7f45df8238ff5c
SHA512

c60e769c1375ee7fb2fe201331ba9f9c90fe9e62d422fea5716ba09b11dfcd142ae767a0ad9415132208f574a0c9f71f4936001ce6fe1f6494e9fa10b4cbfec3
SSDEEP

192:SwzIFC6jIN5IxLwMt+S1Cqan9oEB8LKK706jf:hl6jnbYSUoEB8Hd

Score

N/A

Malware Config

Signatures

Files

3a2e3763fdf62c6b35fa139183191696e5b5d6c9a89707bdbe7f45df8238ff5c
.exe windows x86

11ba203713a8b7dd00df6cf4a5c74e6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
KeDelayExecutionThread
ZwClose
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
memset
strncmp
strlen
IoGetCurrentProcess
ZwOpenKey
ZwEnumerateKey
ZwSetValueKey
ZwCreateFile
_wcslwr
memcpy
wcsncpy
PsGetVersion
MmIsAddressValid
IoRegisterDriverReinitialization
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
PsSetCreateProcessNotifyRoutine
RtlAnsiStringToUnicodeString
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwUnmapViewOfSection

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 886B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 480B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ