3b669bebd5be12fd0e38eba86167128e41960d07a8c806cfd6a0ee37394ba8e0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b669bebd5be12fd0e38eba86167128e41960d07a8c806cfd6a0ee37394ba8e0
Size

20KB
MD5

2c7eccbd57ff34210f33ce7333e6309a
SHA1

5895fb5ca8063ea69468ab5060ade2cef82cafdd
SHA256

3b669bebd5be12fd0e38eba86167128e41960d07a8c806cfd6a0ee37394ba8e0
SHA512

7908036fc9c19f90635843f298ad6ec8aedd42172417087d67cbdaf5f4960bc931735d5998e8fdeef03e4b5f3e38bbd3c315faeb6fb7bac9e9eb302261e8d0f0
SSDEEP

192:VRwSaRLuC98YIBE0hyn8tT3cEZdqpTYPX3tpQ6wiEq297t+/Gt+/Xoa4YnRhOI:76RLuBYIO0v3JEMPX3tpQJPtRtjXYnO

Score

N/A

Malware Config

Signatures

Files

3b669bebd5be12fd0e38eba86167128e41960d07a8c806cfd6a0ee37394ba8e0
.exe windows x86

af586330173dde6bba0e89bcae33d261

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strlen
ZwClose
ExFreePool
ZwWriteFile
strcat
memset
ExAllocatePoolWithTag
ZwCreateFile
RtlInitUnicodeString
strncmp
IoGetCurrentProcess
_except_handler3
RtlFreeUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
_snwprintf
ZwEnumerateKey
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
_wcsnicmp
wcslen
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
isprint

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 988B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ