a4dadf97013966d43b45ad12682cf5a9cd98b51aa1ef13013d37ea5b7ff6abf3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a4dadf97013966d43b45ad12682cf5a9cd98b51aa1ef13013d37ea5b7ff6abf3
Size

2KB
MD5

2cf7fa3ffa08788e8d4b729f33f2d890
SHA1

82a88f67499954380933ab0847023fd7a1e81118
SHA256

a4dadf97013966d43b45ad12682cf5a9cd98b51aa1ef13013d37ea5b7ff6abf3
SHA512

0c136a20a9aed836291f4e344c647565846568ca52b0ec29777fab1f24bfa764e07fa864bcad1ad768dc467b27873aa836435f230c7557a7238717fc827637e4

Score

N/A

Malware Config

Signatures

Files

a4dadf97013966d43b45ad12682cf5a9cd98b51aa1ef13013d37ea5b7ff6abf3
.exe windows x86

246265172e81eccd7f1af4752e7248ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
strncpy
RtlUnicodeStringToAnsiString
ObQueryNameString
IofCompleteRequest
KeDetachProcess
ObfDereferenceObject
ObReferenceObjectByHandle
KeAttachProcess
PsLookupProcessByProcessId
RtlFreeAnsiString
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 576B - Virtual size: 562B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 160B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ