7c384302ccc1723a80d53b99c2ebfaafc11fea1a37bf364c10b1bc23896026fb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7c384302ccc1723a80d53b99c2ebfaafc11fea1a37bf364c10b1bc23896026fb
Size

48KB
MD5

0dc8f21a9d2c14c535eca5e90998c010
SHA1

12be977b1546b7df3ff485d5f364dfede7eb21e9
SHA256

7c384302ccc1723a80d53b99c2ebfaafc11fea1a37bf364c10b1bc23896026fb
SHA512

f670afa5863e7a6d4ceb5dabadc78ab72169de6a1ed9d0b341f75cfa6a73f5b611e2d7d77250c403c207f2efa00f776728d8236c702dcaea32573f6554c5b5e3
SSDEEP

384:LO9Vtmtgjs4/PVRWuKHihbjDJ490j91cXGitgny+fDiY/TjA4hMsNxiqzVirzh8I:UVtmKjswFjtgXGS0PfDdbAN3ZzozpW

Score

N/A

Malware Config

Signatures

Files

7c384302ccc1723a80d53b99c2ebfaafc11fea1a37bf364c10b1bc23896026fb
.exe windows x86

b0872c8677e785c6ab8e3b568a356524

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwCreateFile
ZwSetValueKey
ZwClose
ZwOpenKey
ZwEnumerateKey
MmGetSystemRoutineAddress
RtlInitUnicodeString
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
PsGetVersion
_wcslwr
wcsncpy
PsSetCreateProcessNotifyRoutine
MmIsAddressValid
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
_wcsnicmp
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 900B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 736B - Virtual size: 714B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ