f16ad08ecd6d4902c920bca4b7d62b9fb34ab1fa7f17dd56fce47c04fb0f69b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f16ad08ecd6d4902c920bca4b7d62b9fb34ab1fa7f17dd56fce47c04fb0f69b9
Size

28KB
MD5

a0ddf793a527cb3373d5662a877486c0
SHA1

e14f56cbf146d0f6cd68f38484ffe86529aee0c9
SHA256

f16ad08ecd6d4902c920bca4b7d62b9fb34ab1fa7f17dd56fce47c04fb0f69b9
SHA512

ebc4e7812020863d3d78205dab14756c1a02dfe952900ab0c5deb82b7299743896a55e454b6021773e55aa2746589aeb55a2c0754bffb1b4365fafe52d5154ac
SSDEEP

384:PBmWOJC4b+nuS6v49vNdFmT/G0JJ15H5pSpPQE0qrLVkgaayV8nRVtxjdhUT8iY:xl4R49vFUJ1B54Pf0qrDaam8jLjdhUQ

Score

N/A

Malware Config

Signatures

Files

f16ad08ecd6d4902c920bca4b7d62b9fb34ab1fa7f17dd56fce47c04fb0f69b9
.exe windows x86

45a606670878f0be071bea99803203fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
ObfDereferenceObject
RtlAnsiStringToUnicodeString
wcslen
swprintf
wcscat
wcscpy
_strnicmp
ZwClose
ZwOpenKey
strncmp
MmGetSystemRoutineAddress
strncpy
_stricmp
RtlCopyUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsnicmp

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 800B - Virtual size: 788B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ