dd662e779e789b88c84576f28b3b741c0b91c89e23b6f8ad8b0bbb26265f8e2a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd662e779e789b88c84576f28b3b741c0b91c89e23b6f8ad8b0bbb26265f8e2a
Size

21KB
MD5

b433614c13df760155f29dc657eb81c6
SHA1

4d14d01a36b0efb451ee5aa2cbf362a4149b895a
SHA256

dd662e779e789b88c84576f28b3b741c0b91c89e23b6f8ad8b0bbb26265f8e2a
SHA512

971aed1a203a1703022acacd73dd5b72575be80de82999322dcd9d0ea743d87c1e08f45fa5caff9a8f94c3941f614e42c6f918946474443e519c1cdfe1c7ab5d
SSDEEP

384:T9d+6/18m19v3EyuvymGBiKpcYcYMy/zivqQErmLOx4/M3pORWquGU4vDxDYHjfe:T+eRPCGe

Score

N/A

Malware Config

Signatures

Files

dd662e779e789b88c84576f28b3b741c0b91c89e23b6f8ad8b0bbb26265f8e2a
.exe windows x86

d87ebedae9c82c2e0bebc5cdeed39fb8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_except_handler3
_stricmp
IofCompleteRequest
_strupr
IoGetCurrentProcess
_strlwr
strrchr
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
strncmp
IoDeleteDevice
IoDeleteSymbolicLink

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 768B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 384B - Virtual size: 358B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 506B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ