1bf100fb87743f038108cd506b8a48db08b7c37adebf8a650cd2ce95e8c44f8b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1bf100fb87743f038108cd506b8a48db08b7c37adebf8a650cd2ce95e8c44f8b
Size

28KB
MD5

1ea959c63ee01799df033d6eb16b5200
SHA1

81785a17f3d9b584bcf2be48f06e865b6eeea03c
SHA256

1bf100fb87743f038108cd506b8a48db08b7c37adebf8a650cd2ce95e8c44f8b
SHA512

d4f2a0186732436eac940c0a27d779659cb131fa20265b4dacacca8e6ec47a868e2dc5734b3f8764e60db5a0be1a471386afc79515e2bd41dd88d4e2b2cf0c31
SSDEEP

768:UxNzWnnfdyQF8xbiRH7Rd52dvgrZ4b4r9KLmaDS:UxJWfdVF8g7Rd52Ngrp9Kk

Score

N/A

Malware Config

Signatures

Files

1bf100fb87743f038108cd506b8a48db08b7c37adebf8a650cd2ce95e8c44f8b
.exe windows x86

59900db129b7cec8692a1e970125b6c4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcslen
swprintf
wcscat
wcscpy
_strnicmp
_except_handler3
RtlInitUnicodeString
strncpy
_itow
strncmp
_stricmp
_wcsnicmp
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
ObfDereferenceObject
ZwClose
ZwOpenKey
IofCompleteRequest
ExFreePool
_snprintf
ExAllocatePoolWithTag
MmGetSystemRoutineAddress

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 890B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ