2c6038c02960d9668ab24bd2a220fd2cace8f3a67e870f2b27a7b729cb461ff0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c6038c02960d9668ab24bd2a220fd2cace8f3a67e870f2b27a7b729cb461ff0
Size

12KB
MD5

4574e11e9e44ec23319300773e4aeb70
SHA1

576d653c752e48233dab3fcf2bc3af29747a67ee
SHA256

2c6038c02960d9668ab24bd2a220fd2cace8f3a67e870f2b27a7b729cb461ff0
SHA512

b4746a7eda9d7f3f2c21d041c602f51f2b3e528a279f207f060710d62149ab8afa05b8d6b25cf77927832aeade3874a313a476571d4923f1833a099abfda27e4
SSDEEP

192:nhxQ1g5yiUzEHZRG73iijwM4N/k2FBqocRo/Od3f7iv7WnaOWW7br8:bFSEneHopk8A9f7+7WnaOWW7

Score

N/A

Malware Config

Signatures

Files

2c6038c02960d9668ab24bd2a220fd2cace8f3a67e870f2b27a7b729cb461ff0
.exe windows x86

6c1c47250f04345270a283e47b3fc4e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlPrefixUnicodeString
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlEqualUnicodeString
NtQueryDirectoryObject
NtOpenDirectoryObject
RtlInitUnicodeString
wcslen
NtSetInformationFile
wcscpy
NtOpenFile
wcsncpy
RtlFreeHeap
NtSetValueKey
wcsstr
_wcslwr
RtlAllocateHeap
NtQueryValueKey
NtOpenKey
RtlOemToUnicodeN
NtReadFile
NtQueryInformationFile
NtCreateFile
wcschr
qsort
RtlReAllocateHeap
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlUnwind
NtQueryVirtualMemory
DbgBreakPoint
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE