eaddf92c4e522dc4d74582d1a2a9bff30ebda396339672e88947591873572297 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eaddf92c4e522dc4d74582d1a2a9bff30ebda396339672e88947591873572297
Size

4KB
MD5

0740476dc985099d1d48572393d89900
SHA1

b6fc44531c84ab1d377b8ccb0edffebaf22fc552
SHA256

eaddf92c4e522dc4d74582d1a2a9bff30ebda396339672e88947591873572297
SHA512

a1ee58bfa4ca40f4b6192c21c03067b0532871dd61e82a45453fc31218eb87ef4eb106c9d6a6cc801572c2853721697a1d1def51caed8806c4af03bf255f03e4

Score

N/A

Malware Config

Signatures

Files

eaddf92c4e522dc4d74582d1a2a9bff30ebda396339672e88947591873572297
.exe windows x86

597aaaf062b5aa40ab252f0ce2f6d469

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwReadFile
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
ZwWriteFile
ZwSetValueKey
RtlInitUnicodeString
ZwQueryInformationFile
ZwCreateKey
ZwCreateFile
ZwClose
NtLockFile

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 320B - Virtual size: 318B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 224B - Virtual size: 218B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ