cfb0e98fb5cab5440d89873c16a0820157d392a068d756286561677ae78d3b87 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfb0e98fb5cab5440d89873c16a0820157d392a068d756286561677ae78d3b87
Size

29KB
MD5

084c2b1d428fb7885147e1dd1acbaf65
SHA1

3d7f7babf2bf1f88bdb57564a48f64ace9314c96
SHA256

cfb0e98fb5cab5440d89873c16a0820157d392a068d756286561677ae78d3b87
SHA512

aa0b6c6b7cf8fb94934ffbf55d99dd7d474f25b6106b435cda1a23a65060cf99a0d14a6af771087fbdc005c3eb23a7a92f4c7e95e443467bf746a5aa904c50ac
SSDEEP

768:TuHRZpHcLu7zj1cRu55YS81VEob6xPiiJP6TX7XMsiDlxiJHWkxL:Tux57z2u55YS81VLuhiisTXLKML

Score

N/A

Malware Config

Signatures

Files

cfb0e98fb5cab5440d89873c16a0820157d392a068d756286561677ae78d3b87
.exe windows x86

d516a30663b60b8f89dcaaba99ed6b9a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
_wcsnicmp
wcslen
strncmp
strncpy
RtlAnsiStringToUnicodeString
_stricmp
ExFreePool
_snprintf
ExAllocatePoolWithTag
ObfDereferenceObject
ZwClose
ZwOpenKey
wcscat
wcscpy
RtlCopyUnicodeString
_strnicmp
swprintf
MmGetSystemRoutineAddress

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 800B - Virtual size: 792B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ