8d1c7cbc4624d80951cc603f8b5ce1e9de543acada1fd3c6c653c3281b5f1015 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d1c7cbc4624d80951cc603f8b5ce1e9de543acada1fd3c6c653c3281b5f1015
Size

20KB
MD5

d0ca036a43dd3e1efbfbfeba2a17dfed
SHA1

ccc56ff1bc814847c5d68d949252a18d14c315f4
SHA256

8d1c7cbc4624d80951cc603f8b5ce1e9de543acada1fd3c6c653c3281b5f1015
SHA512

db0998a181a48f4ed88fc7da7e15025ad1d7a77466fdc01cfc40c9575301cf94a0250f85f8db7eb2263a674959b58390fc387d2d373b36483aa5c71f308aa8ea
SSDEEP

384:YrajMxvnZyJFfeTTKem8CUGrU2ZsoiJMPFunk6LFzdaR+/CRyRmj740SfZ6Y:Y+jMxvnIJFfeTTKQCUYLtSMPFuk6ZwR0

Score

N/A

Malware Config

Signatures

Files

8d1c7cbc4624d80951cc603f8b5ce1e9de543acada1fd3c6c653c3281b5f1015
.exe windows x86

e59858b3b5a2ca45815ddb27887cf37b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
ZwClose
RtlInitUnicodeString
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
swprintf
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
ZwCreateKey
wcscat
wcscpy
ZwCreateFile
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
MmIsAddressValid
ZwUnmapViewOfSection
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
PsGetVersion
_wcslwr
wcsncpy

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ