62f29412b2b85c8e1cd74ad3d913c4d596f6b8c7bf98a1b40f2055518b752312 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

62f29412b2b85c8e1cd74ad3d913c4d596f6b8c7bf98a1b40f2055518b752312
Size

12KB
MD5

a264d435fe0e018fc69b45e81b214390
SHA1

b93b511268b3bac5406fc6e464d9b8f725d3a435
SHA256

62f29412b2b85c8e1cd74ad3d913c4d596f6b8c7bf98a1b40f2055518b752312
SHA512

96b76375321583164d21c237aadc955b8543f1d2852e5e087e8d198440cadd1fb9c6934107e1c4c167ba28b20c14944a22e7a22166a331d0cd026dda56360123
SSDEEP

192:nhxQ1g5yiUzEHZRG73iijwM4N/k2FBqocRo/Od3f7iv7WnaOW9llNkj4nkm:bFSEneHopk8A9f7+7WnaOW9ll1L

Score

N/A

Malware Config

Signatures

Files

62f29412b2b85c8e1cd74ad3d913c4d596f6b8c7bf98a1b40f2055518b752312
.exe windows x86

6c1c47250f04345270a283e47b3fc4e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlPrefixUnicodeString
NtClose
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlEqualUnicodeString
NtQueryDirectoryObject
NtOpenDirectoryObject
RtlInitUnicodeString
wcslen
NtSetInformationFile
wcscpy
NtOpenFile
wcsncpy
RtlFreeHeap
NtSetValueKey
wcsstr
_wcslwr
RtlAllocateHeap
NtQueryValueKey
NtOpenKey
RtlOemToUnicodeN
NtReadFile
NtQueryInformationFile
NtCreateFile
wcschr
qsort
RtlReAllocateHeap
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlUnwind
NtQueryVirtualMemory
DbgBreakPoint
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE