fc3bc5b96e3053c7f65c8c5928bd7f238b6d91d03917f4462d14fe0551667f3d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc3bc5b96e3053c7f65c8c5928bd7f238b6d91d03917f4462d14fe0551667f3d
Size

21KB
MD5

0409a6f420fa4114c2e32fa74442c3b0
SHA1

bd67f38719ed8803df9de8a89775bdec69e55b9c
SHA256

fc3bc5b96e3053c7f65c8c5928bd7f238b6d91d03917f4462d14fe0551667f3d
SHA512

0791050e6c2481a29ab7619d17f10848007a5af6ec57e897310a0c761f99bcdab392d8cf4fe028aca68ff54d3647e49af1289addfd329f428d2340355f604a7f
SSDEEP

384:NEJAXZkMT50K/1juuUecgiSDJJzIXuIaTeoP9ZJEqG5mT3ZrLC:KJeZkMT5lKuUecgiSDJJguIaTeSJHdTZ

Score

N/A

Malware Config

Signatures

Files

fc3bc5b96e3053c7f65c8c5928bd7f238b6d91d03917f4462d14fe0551667f3d
.exe windows x86

d725fdd940c2446b6b6be3f001c0e0b8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeDelayExecutionThread
ZwClose
ZwCreateKey
wcslen
swprintf
RtlInitUnicodeString
wcscat
wcscpy
strncmp
IoGetCurrentProcess
_wcsnicmp
MmIsAddressValid
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
PsGetVersion
_wcslwr
wcsncpy
ZwCreateFile
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwUnmapViewOfSection
RtlAnsiStringToUnicodeString
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 576B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ