1ed31ff71576e6891658d979df387476c9639884a576d329afe6135e3336702d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ed31ff71576e6891658d979df387476c9639884a576d329afe6135e3336702d
Size

28KB
MD5

0c07b1c9638609b10ba9a7e3924f54b9
SHA1

0340a690b5ad0725fa100f16b2fb18fd760aca90
SHA256

1ed31ff71576e6891658d979df387476c9639884a576d329afe6135e3336702d
SHA512

d1ebb7c92136b007d54c090e7213fbf25b355e5b3fb2c4403b26751677668e7f2480499fb14e90b03ce0086e47c65e133ca871996f5b2eab51afd49bea2b8c89
SSDEEP

768:N0Xu/krWBCh9nQZxLbl4y5NEe4Cqk4NJqgGZ0:N0g29QZxLLEeSLqBG

Score

N/A

Malware Config

Signatures

Files

1ed31ff71576e6891658d979df387476c9639884a576d329afe6135e3336702d
.exe windows x86

556cf4431384e4edf00e625a90938379

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

swprintf
RtlInitUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
strncpy
_strnicmp
strncmp
ZwClose
ZwOpenKey
IofCompleteRequest
wcslen
wcscat
wcscpy
_except_handler3
_itow
ObfDereferenceObject
_stricmp
MmGetSystemRoutineAddress
_wcsnicmp
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 862B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ