c9569003182af0c5da37a4196e951ef924d4275bba97c9766fb4abc15de7eabb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c9569003182af0c5da37a4196e951ef924d4275bba97c9766fb4abc15de7eabb
Size

26KB
MD5

5961713b4ea7fe2b76c4019b1158fd0d
SHA1

d091998d1786e5fdd800ed9edf1c2706cb668827
SHA256

c9569003182af0c5da37a4196e951ef924d4275bba97c9766fb4abc15de7eabb
SHA512

675e61bb346e0e3a7d04a8958cff4c640b9cec16a25fceb60b60afdede5cf420af67a6e935e0d5e22613f37b7b3eabe4b5ba2b9ba936e0e36942dde4ecb49046
SSDEEP

384:Xv5YL3pfOi3QXEh6NMtJSeabZRixaPv5fewZB:/WZf9rh0EZOXMa3owz

Score

N/A

Malware Config

Signatures

Files

c9569003182af0c5da37a4196e951ef924d4275bba97c9766fb4abc15de7eabb
.exe windows x86

0e8731514207adc83eb5d57cc6ff83e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwCreateFile
ZwEnumerateKey
ZwSetValueKey
ZwClose
ZwOpenKey
MmIsAddressValid
ZwUnmapViewOfSection
RtlFreeUnicodeString
KeDelayExecutionThread
wcslen
ZwCreateKey
swprintf
RtlInitUnicodeString
wcscat
wcscpy
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlAnsiStringToUnicodeString
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
IoRegisterDriverReinitialization
_wcslwr
wcsncpy
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 986B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 672B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ