16a815e2d73195eb86a86d4b2d0cdd9dc9193eb91aefad0065885960b769286e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16a815e2d73195eb86a86d4b2d0cdd9dc9193eb91aefad0065885960b769286e
Size

28KB
MD5

a26f0cea5c12f994bd5ab962ec936380
SHA1

9549f588af3762a33caade3a0f1142828b5aa97a
SHA256

16a815e2d73195eb86a86d4b2d0cdd9dc9193eb91aefad0065885960b769286e
SHA512

87a8e4b836e96c1a70c094df63b8363f4bbf94a16a47944d49d9848694f1cf70df9b745cb09202b0d86179b252685a3e071be5af63c2f22234a91b496f7fbdfc
SSDEEP

768:nIdXkqUUxZwERIRAnc6Yp3652lKitUBSBJUVd0dwi:nvq8OncxtrjBe

Score

N/A

Malware Config

Signatures

Files

16a815e2d73195eb86a86d4b2d0cdd9dc9193eb91aefad0065885960b769286e
.exe windows x86

299539890df6c6cfa6f1009148f356c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
swprintf
MmIsAddressValid
_strnicmp
RtlCompareUnicodeString
RtlInitUnicodeString
ExGetPreviousMode
strncpy
IoGetCurrentProcess
wcscat
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
wcslen
_stricmp
strncmp
_wcsnicmp
wcscpy
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
MmGetSystemRoutineAddress
_except_handler3
RtlCopyUnicodeString
IofCompleteRequest
ObfDereferenceObject
ObQueryNameString

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 736B - Virtual size: 724B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ