3e3483cd00274924f047fd7d0b17de82f711ea4c4ee7b2c23775f982662fb025 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e3483cd00274924f047fd7d0b17de82f711ea4c4ee7b2c23775f982662fb025
Size

119KB
MD5

0dd39f7ff1f58ac302e70629af2d7780
SHA1

ca8ec11e5df224683d4ddb15bb4616b1c1b6984b
SHA256

3e3483cd00274924f047fd7d0b17de82f711ea4c4ee7b2c23775f982662fb025
SHA512

b45f5312bba5487b3352a4d9306dbd8b1734ea19fefd202281e823b9b9f1c6f96a90c144ed22d32fb2431c50611b13d18428118c58069719863af875e39fca8a
SSDEEP

3072:/RYzx+tx3KaydkRUKIqpP6Cn3vYDD1ty5v:9tx3KaydGUKIq4I3vGD1t

Score

N/A

Malware Config

Signatures

Files

3e3483cd00274924f047fd7d0b17de82f711ea4c4ee7b2c23775f982662fb025
.exe windows x86

eb4f60bac07234e2083ddab15ee76866

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePool
_stricmp
RtlInitAnsiString
RtlAnsiStringToUnicodeString
ZwReadFile
ExAllocatePoolWithTag
ZwClose
ZwQueryInformationFile
ZwCreateFile
ExFreePool
ExFreePoolWithTag
memcpy
strcat
RtlFreeUnicodeString
ZwQuerySystemInformation
KeServiceDescriptorTable
strcpy
InterlockedExchange

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 480B - Virtual size: 468B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 96B - Virtual size: 70B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ