7acc09e6565ae85dbeb964b8e6e6efdc9c19e8e287a4b0b6600c2d6ebee16fdf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7acc09e6565ae85dbeb964b8e6e6efdc9c19e8e287a4b0b6600c2d6ebee16fdf
Size

28KB
MD5

1240d9c211c19fb82d6804c543d6f680
SHA1

b9259155d20b469fa6249f4cf49ffdcc1f1d648c
SHA256

7acc09e6565ae85dbeb964b8e6e6efdc9c19e8e287a4b0b6600c2d6ebee16fdf
SHA512

ea8eca5e8bed2a81bb318b1175e3070740d77f074e7f35d0cfd34f0ca9e685d45f62dfb2e3d26270237c4e2e7c39d20dc37e7e518c14d7403c20be33d987ff53
SSDEEP

768:Dx+EDxfk/OytnfRfWbs6y3NaGVNVdVySHM5QWXu:DxRfKLJb68NaGVNVdVyNQE

Score

N/A

Malware Config

Signatures

Files

7acc09e6565ae85dbeb964b8e6e6efdc9c19e8e287a4b0b6600c2d6ebee16fdf
.exe windows x86

0a477310476e1830c15dddfa7f3021df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
wcslen
swprintf
_stricmp
wcscat
wcscpy
IofCompleteRequest
ExFreePool
ExAllocatePoolWithTag
_snprintf
ZwQuerySystemInformation
ZwUnmapViewOfSection
ObfDereferenceObject
ObQueryNameString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
strncpy
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlAnsiStringToUnicodeString
_strnicmp
RtlCompareUnicodeString
ExGetPreviousMode
_except_handler3
RtlCopyUnicodeString

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 736B - Virtual size: 724B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ