ea7ffb548d6e23af69bfad1894df1ad59ddd9b33a212d7d9fd5655a11833c391 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea7ffb548d6e23af69bfad1894df1ad59ddd9b33a212d7d9fd5655a11833c391
Size

445KB
MD5

73f2576dbc98b756b09e974033a8f5b9
SHA1

b9e871a638b6c2d5e2a689c07cb956224e27571d
SHA256

ea7ffb548d6e23af69bfad1894df1ad59ddd9b33a212d7d9fd5655a11833c391
SHA512

647e202a5d0e5a26a3d05198d0180d1957db4907260eec8a7e399cc3acbe328603eb08cdbfd27cb679a01436c056d5f07bee903b06c66a761dc5232332ed1881
SSDEEP

12288:Ot23mj0nNn5wdGimMOrbAXhpNAX1TrJsNK+:iAnNnyOrbADNAXB9+

Score

N/A

Malware Config

Signatures

Files

ea7ffb548d6e23af69bfad1894df1ad59ddd9b33a212d7d9fd5655a11833c391
.dll windows x86

74b17350f8a52940cd8577f130de3dc2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

FsRtlLookupLastLargeMcbEntry
ZwQuerySymbolicLinkObject
PsLookupProcessByProcessId
KeCancelTimer
RtlInitString
RtlFreeAnsiString
KeInitializeTimerEx
FsRtlSplitLargeMcb
RtlCompareString
RtlEqualUnicodeString
KdDisableDebugger
ObReferenceObjectByPointer
IoGetAttachedDevice
ExReinitializeResourceLite
PsGetVersion
strncpy
RtlCreateUnicodeString
MmGetSystemRoutineAddress
MmSizeOfMdl
IoGetDeviceToVerify
RtlIntegerToUnicodeString
RtlEqualString
RtlInitUnicodeString
ZwClose
RtlInitAnsiString
ExDeleteNPagedLookasideList
ObGetObjectSecurity
RtlCharToInteger

Sections

.text
Size: 23KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ