173ca80646e0f514c22ac46d803436ac7ee9feec322617e7a6cdbdbb8a70a2d7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

173ca80646e0f514c22ac46d803436ac7ee9feec322617e7a6cdbdbb8a70a2d7
Size

24KB
MD5

92f739904fbea06fc915edeabdee4ed0
SHA1

5be7b9d692a570e2d0ed0364a3de460faa65a9e7
SHA256

173ca80646e0f514c22ac46d803436ac7ee9feec322617e7a6cdbdbb8a70a2d7
SHA512

3552d93e9558248641503334f755998ab84f467f02697b7acbbe230e248d49f4f4fd8f7cc6e0e17db253edf3b985dab012a366e2e66eb9ab92caf08f58804d24
SSDEEP

768:hBx+740940940940940940940Z4wBd/lhv6urXI5:vxDQdNR68q

Score

N/A

Malware Config

Signatures

Files

173ca80646e0f514c22ac46d803436ac7ee9feec322617e7a6cdbdbb8a70a2d7
.exe windows x86

cd9acb7c3ec5a89486c0c1925c07b750

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwQuerySystemInformation
MmUserProbeAddress
ZwReadFile
ZwCreateFile
ZwQueryInformationProcess
ZwPulseEvent
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IoCreateDevice
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
strncmp
IoGetCurrentProcess
strrchr
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
ZwClose
IofCompleteRequest
_stricmp
IofCallDriver
_except_handler3

hal

KfLowerIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel

Sections

udfThrj
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 966B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 928B - Virtual size: 898B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ