a5cac2ff557c52f57f104a96c844b957fff0e3904cf43d99310f4b1a05e908c7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5cac2ff557c52f57f104a96c844b957fff0e3904cf43d99310f4b1a05e908c7
Size

8KB
MD5

e9ec5478b6c90a2ed8401104619d52c8
SHA1

f4db6b8ffbc578cfe0874af74a5cb2424b470599
SHA256

a5cac2ff557c52f57f104a96c844b957fff0e3904cf43d99310f4b1a05e908c7
SHA512

efc32cb5bdd6a917a747bc4c40550c3559dc6c28e699c08f95d4a7296ce3aecb192637ab8d253b0f23254d0ffde2d2f9c3c1fa3052c28357252523069f670d25
SSDEEP

192:a2gjzUNC5lfoItpNXHIIq2/Y1cI18sDZ:aTXGCd9tpNXU2/YP13

Score

N/A

Malware Config

Signatures

Files

a5cac2ff557c52f57f104a96c844b957fff0e3904cf43d99310f4b1a05e908c7
.exe windows x86

01e0fdc0909ce8e963f12e4f5ad93105

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwPulseEvent
ExFreePoolWithTag
ExAllocatePoolWithTag
MmIsAddressValid
_wcsicmp
ZwQueryInformationProcess
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
wcscpy
wcsrchr
ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType
KeDelayExecutionThread
_allmul
PsCreateSystemThread
KeInitializeSpinLock
MmGetSystemRoutineAddress
ZwQuerySystemInformation
_except_handler3

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 768B - Virtual size: 700B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ