af20f1c675bddb44af7bcaa6386bbe151e137f962b928e25a934e7e4302c2cb5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af20f1c675bddb44af7bcaa6386bbe151e137f962b928e25a934e7e4302c2cb5
Size

28KB
MD5

0bbdebfcb2729899bc598fa359f58830
SHA1

94861c864b3bd0cea58b35513eba716f982a5ec9
SHA256

af20f1c675bddb44af7bcaa6386bbe151e137f962b928e25a934e7e4302c2cb5
SHA512

1a5c9f055c88dbd02a68abed9d9450dc6e5c1d1466f4aaf98ceb3c3221bb7e38b021af7a42458460ab8ff6931bc3cfece74721b097490b518c87cb15c515c864
SSDEEP

768:RyLX0IpFKvduGEgBCTAS2nzy4dmVsoSi0d/EMaTGuV/uB:A0MFKFF0Trx4EV3MaTGec

Score

N/A

Malware Config

Signatures

Files

af20f1c675bddb44af7bcaa6386bbe151e137f962b928e25a934e7e4302c2cb5
.exe windows x86

b51011d5326756881ed8b660d73e19e4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcscat
wcscpy
swprintf
strncpy
_stricmp
RtlInitUnicodeString
ObfDereferenceObject
strncmp
wcslen
ExFreePool
_snprintf
ExAllocatePoolWithTag
_strnicmp
RtlAnsiStringToUnicodeString
ZwClose
ZwOpenKey
_wcsnicmp
RtlCopyUnicodeString
MmGetSystemRoutineAddress

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 832B - Virtual size: 816B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ