bf3936f852a1f2b4fe3e9b0c246e5c8934f3056c5313e9ebce73f68e26e74fb4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf3936f852a1f2b4fe3e9b0c246e5c8934f3056c5313e9ebce73f68e26e74fb4
Size

21KB
MD5

fd99b4f0dfec52d6dba528e9866b3b17
SHA1

354c29ddaba7f6b567a292230c3ee59844b9db36
SHA256

bf3936f852a1f2b4fe3e9b0c246e5c8934f3056c5313e9ebce73f68e26e74fb4
SHA512

905bafa565b58395ae1f8963c823b4c9f753213b07f54010e201b1bcfb40a4af38d4304c5904cab052a4dcabdfe7cda20960d376365dc73320b85b76fc8f2171
SSDEEP

384:fe6wfiIQD4KmuJOMoNqedvfpoJ4NKPRMUsgcURNyTBD:efAJ2dQdV73KN

Score

N/A

Malware Config

Signatures

Files

bf3936f852a1f2b4fe3e9b0c246e5c8934f3056c5313e9ebce73f68e26e74fb4
.exe windows x86

b63692ba59f2590d69b5ef42e4e71263

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwOpenThread
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
KeServiceDescriptorTable
ZwWriteFile
ZwTerminateProcess
ZwSetValueKey
ZwReadFile
ZwQueryInformationProcess
ZwQueryInformationFile
ZwQueryDirectoryFile
RtlInitUnicodeString
ZwOpenProcess
ZwDeleteFile
ZwCreateKey
ZwCreateFile
ZwClose
ZwAllocateVirtualMemory
RtlCompareUnicodeString
NtLockFile
_strnicmp
PsLookupProcessByProcessId

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 816B - Virtual size: 814B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 608B - Virtual size: 606B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ