da1cefc9c67d2e9c82fdd0f5ec38efb1308540d9c80a09ddaec38bf5eafaab50 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da1cefc9c67d2e9c82fdd0f5ec38efb1308540d9c80a09ddaec38bf5eafaab50
Size

20KB
MD5

02a9d36c7ad435376390a379bbc9e9d0
SHA1

31999f583eb4c2859d426eb2c523c5632a560420
SHA256

da1cefc9c67d2e9c82fdd0f5ec38efb1308540d9c80a09ddaec38bf5eafaab50
SHA512

c03865f5365571e926697b064234c55e8e786c1fd9af0e0f517ccb5f825079e512122ff3e638ea9766cccae64b4b38586983c1beaf6ca3a3dd8c2ac36ad3cb68
SSDEEP

384:mXMbwlbnhG60+rHkZB5lCujeJBAjMHsIpiKnE4T7pYF4u3UVaDwBt3oZSbMtGPSC:wM0/1HOEsIpiKE4T7pYF4u3UVaDwBt3Q

Score

N/A

Malware Config

Signatures

Files

da1cefc9c67d2e9c82fdd0f5ec38efb1308540d9c80a09ddaec38bf5eafaab50
.exe windows x86

944dabc53d838a8ff8c380866017680c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
RtlFreeUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
RtlInitUnicodeString
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
ExFreePool
wcscpy
_snwprintf
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
_wcsnicmp
wcslen
strstr
ZwQueryValueKey
ZwCreateKey
KeServiceDescriptorTable
PsGetVersion
ZwCreateFile
IofCompleteRequest
MmGetSystemRoutineAddress
strncmp
IoGetCurrentProcess
_except_handler3
_stricmp
ZwWriteFile
RtlCompareUnicodeString
ExGetPreviousMode

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 864B - Virtual size: 864B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ