58ad25b584b7f6f70161e8bde73e60675f691c078c6c76429f584c0b2177b8ed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

58ad25b584b7f6f70161e8bde73e60675f691c078c6c76429f584c0b2177b8ed
Size

8KB
MD5

086c3eaca396d86300a9cc6a35bd3661
SHA1

142a952bb2e4d1000066e97cf26057eb9d4dac4d
SHA256

58ad25b584b7f6f70161e8bde73e60675f691c078c6c76429f584c0b2177b8ed
SHA512

a08f6de91f7a902b291aadd951ed6d4fbb788ec453c8bf6f33a66a15e5db6da2a32c19b3037843039cb67f827bbbcf7f0cb26fa2925a6ec66e36877424ebc36c
SSDEEP

192:TowhTkKoybGgqR4DLaHTMf+4ITZowfe1Lzn:9hzbGg9XJm4uRGJz

Score

N/A

Malware Config

Signatures

Files

58ad25b584b7f6f70161e8bde73e60675f691c078c6c76429f584c0b2177b8ed
.exe windows x86

b7a9ada452380dbef2c10f17db0ca25c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlInitUnicodeString
_except_handler3
IoCreateFile
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IofCompleteRequest
ZwClose
KeServiceDescriptorTable
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
wcslen

hal

KeGetCurrentIrql

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 890B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ