a1f172b2dac4b7e003bef59888985f19ddffef8de272803ded5bd3b15d66db27 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1f172b2dac4b7e003bef59888985f19ddffef8de272803ded5bd3b15d66db27
Size

18KB
MD5

441e3ecb33d230c0d9e1cd0aec15cd70
SHA1

a13df3283f4575e35649e19611977e8a49b6cfbe
SHA256

a1f172b2dac4b7e003bef59888985f19ddffef8de272803ded5bd3b15d66db27
SHA512

5b1f2084c80c05d2e64e763fdf227b2675721b9c33f4277bba713bea5f02a4c235f91e515cec380fc2b54dc7d3190123446aec51e02c64c9affa23d30c70c8fa
SSDEEP

384:mudfVyjS6tVCujeJBAjMHsIpiKnE4T7pYF4u3UVaDwBt3oZSbMtGPSxIOkCWhF/9:LMWsIpiKE4T7pYF4u3UVaDwBt3oZSbMM

Score

N/A

Malware Config

Signatures

Files

a1f172b2dac4b7e003bef59888985f19ddffef8de272803ded5bd3b15d66db27
.exe windows x86

7c82d5ed32907ab6c262d1ae4167dae6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strlen
ZwClose
ExFreePool
ZwWriteFile
strcat
memset
ExAllocatePoolWithTag
ZwCreateFile
RtlInitUnicodeString
_stricmp
strncmp
IoGetCurrentProcess
_except_handler3
ZwSetValueKey
strstr
ZwQueryValueKey
ZwCreateKey
wcscat
wcscpy
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
_snwprintf
ZwEnumerateKey
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
_wcsnicmp
wcslen
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ