cfa50383b90a07ac79acac5f4e28e6d400c1aeea01a8fb2567a20529d50ef863 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfa50383b90a07ac79acac5f4e28e6d400c1aeea01a8fb2567a20529d50ef863
Size

29KB
MD5

0a794bbfb8340d7553b6d1a191fa4d10
SHA1

030e91646aa20de1717a12e11b870ada19ccd141
SHA256

cfa50383b90a07ac79acac5f4e28e6d400c1aeea01a8fb2567a20529d50ef863
SHA512

154b44b59b1081a0fa4917c5f02839c05df3432cbbaf8eb4424eecf07b29160df684b44b368e5796a7728075b956e780c518526edd9c6d42c453cc5bb2d1ed7b
SSDEEP

768:KMNl6VATIUOxFEObVPP4iHxi1drhbrfu6:36WTBUhPgca5h

Score

N/A

Malware Config

Signatures

Files

cfa50383b90a07ac79acac5f4e28e6d400c1aeea01a8fb2567a20529d50ef863
.exe windows x86

866a25dde77a7b1bb1fe0b34b63cc5e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcslen
RtlInitUnicodeString
_wcsnicmp
swprintf
wcscat
wcscpy
_stricmp
strncpy
IofCompleteRequest
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
IoGetCurrentProcess
MmGetSystemRoutineAddress
RtlCompareUnicodeString
MmIsAddressValid
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
strncmp
RtlCopyUnicodeString
ZwUnmapViewOfSection
_except_handler3
_strnicmp
RtlAnsiStringToUnicodeString
ObfDereferenceObject
ObQueryNameString

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 704B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ