bfa670733d9708fd13aba4b7b0933e06927dea1c3ba2d4d0ad901e26d97a51c5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bfa670733d9708fd13aba4b7b0933e06927dea1c3ba2d4d0ad901e26d97a51c5
Size

28KB
MD5

0e617fd7cd6358e222326e97c0cb89e0
SHA1

bc7adfb1156aa9227d8e75a7d545eaacbe01f93c
SHA256

bfa670733d9708fd13aba4b7b0933e06927dea1c3ba2d4d0ad901e26d97a51c5
SHA512

f53a0d1edc25cd520693081e19c1249b58b697eb1c487899143aa04d084034d7eb7c4b9ff1fa11361437e16f0bf7cacd0ba75dc63614d848d6d44f69d798e667
SSDEEP

768:pEalpLe7S1/H9Z+Q1TYC7hw1ib3IX5q+nIaqstVuBBUw/Te:ppLeGB9ZHlYC7hb3H+IazVuBBUw

Score

N/A

Malware Config

Signatures

Files

bfa670733d9708fd13aba4b7b0933e06927dea1c3ba2d4d0ad901e26d97a51c5
.exe windows x86

b4ef07979b80b803043d90ad9800e764

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcscat
wcscpy
_itow
ZwClose
RtlInitUnicodeString
ZwOpenKey
RtlCopyUnicodeString
_strnicmp
MmGetSystemRoutineAddress
wcslen
strncmp
_stricmp
strncpy
_except_handler3
RtlAnsiStringToUnicodeString
ObfDereferenceObject
swprintf
ExFreePool
_snprintf
ExAllocatePoolWithTag
IofCompleteRequest
_wcsnicmp

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 910B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ