b9c92cfda5a68dd3669246deb4e14e2823e741d359e958cecc4ab3211049d7e7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9c92cfda5a68dd3669246deb4e14e2823e741d359e958cecc4ab3211049d7e7
Size

31KB
MD5

d6bf26160dac94da310eaceb1915fc60
SHA1

2bce45fae294b64d62b9379581fa24e1f6153a79
SHA256

b9c92cfda5a68dd3669246deb4e14e2823e741d359e958cecc4ab3211049d7e7
SHA512

ca4eed22c97b7bcd84f406130e8b93c6bfbee394606e0637bb3d117fd7db94ddeb5bc848d38e8d9eaf90ec88f92003f29f4d5a9b2f6b6f608b7d21a58321d4f6
SSDEEP

384:qgfWN9oiPf+EBExX5alTcvzo4aioHSTcwmyYQd+V4GyHOOUrXon9NOn+W:qyWN6of+EuxX5adcvzboyTKQdP7e+

Score

N/A

Malware Config

Signatures

Files

b9c92cfda5a68dd3669246deb4e14e2823e741d359e958cecc4ab3211049d7e7
.exe windows x86

906b94e4ad387c9f2c2fdaacf9c41299

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcscpy
wcscat
RtlInitUnicodeString
MmGetSystemRoutineAddress
MmIsAddressValid
swprintf
_stricmp
strncpy
wcslen
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
_except_handler3
ExFreePool
ExAllocatePoolWithTag
_wcsnicmp
ObfDereferenceObject
ObQueryNameString
IofCompleteRequest
_strnicmp
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlCopyUnicodeString
strncmp
IoGetCurrentProcess
RtlCompareUnicodeString
_snprintf
ZwQuerySystemInformation

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 704B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ