f88970e4b95069fabac229c78f1b2c8834dc04099275d3c591d7ab2456eb125b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f88970e4b95069fabac229c78f1b2c8834dc04099275d3c591d7ab2456eb125b
Size

6KB
MD5

a770c2c612dee984472d27e246851a54
SHA1

1a98239e4e2a0444a3960aa177058a70f246300d
SHA256

f88970e4b95069fabac229c78f1b2c8834dc04099275d3c591d7ab2456eb125b
SHA512

fb9b06faebe553306b65766b85262f41bbaf94f346b3388cda7267c4705d621db700de791325c42abce12f16c2ca0f4ae31925af9378fa1c11b26c5b20f5db75
SSDEEP

96:w2sVAMwvFAvNFzwS4XD9fe6B/Y5ISJ1aNDEKlH5u5+gS0AKtMzqLx:1MFNF8HGISJ1wDrlkggr3x

Score

N/A

Malware Config

Signatures

Files

f88970e4b95069fabac229c78f1b2c8834dc04099275d3c591d7ab2456eb125b
.exe windows x86

bb987107c12db4043bce620809ac5191

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
ObOpenObjectByPointer
_except_handler3
IoCreateFile
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmUnmapViewOfSection
ZwClose
ZwSetValueKey
wcslen
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwCreateKey
RtlInitAnsiString
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IofCompleteRequest
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
PsLookupProcessByProcessId

hal

KeGetCurrentIrql

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 354B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ