b86b077d7cda907e5d8ee5cf0ddd6af0be19280f09380f71264c2149cd8f01b2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b86b077d7cda907e5d8ee5cf0ddd6af0be19280f09380f71264c2149cd8f01b2
Size

29KB
MD5

3ed27630ad45ef065871c2935c414642
SHA1

73bd09f0802198d99705620269390f9b3e9376b1
SHA256

b86b077d7cda907e5d8ee5cf0ddd6af0be19280f09380f71264c2149cd8f01b2
SHA512

0cbdb8d2ede796f7a2795a907762f70bc69b86fa30913a304d594e74443cca7e1fa6c335eeff058c0dc79c9809233c49ac4661506dd9f9889d79a331da51ce5f
SSDEEP

768:dDJJXAhFgDCklD8TP0yGEl3/Jsdt6pLpipH1CUDVJ:TFAhFgjl1EhjpLpipVC

Score

N/A

Malware Config

Signatures

Files

b86b077d7cda907e5d8ee5cf0ddd6af0be19280f09380f71264c2149cd8f01b2
.exe windows x86

21efce02bd4f686d5144d60090be7cc9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
RtlCopyUnicodeString
RtlInitUnicodeString
swprintf
wcslen
ObfDereferenceObject
ObQueryNameString
wcscat
_stricmp
strncmp
IoGetCurrentProcess
_wcsnicmp
wcscpy
strncpy
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlCompareUnicodeString
ZwUnmapViewOfSection
IofCompleteRequest
RtlAnsiStringToUnicodeString
MmIsAddressValid
_strnicmp
MmGetSystemRoutineAddress
_except_handler3

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 704B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ