854e11639407127de9046cc80db025b450ceb0a568e33e890981282ff4bb4e93 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

854e11639407127de9046cc80db025b450ceb0a568e33e890981282ff4bb4e93
Size

31KB
MD5

50ab186ddf9fae285995b8b4d81954a4
SHA1

949957e30bc2adb15afc8dc9da16c58df1359296
SHA256

854e11639407127de9046cc80db025b450ceb0a568e33e890981282ff4bb4e93
SHA512

ad2b3587445b31c6ae0460010114da13c0c7f4a12cd020783f463737701e158c0c6db2517f0bfdb373c621c9097a0de26b0506ed481c90c139a7b19fba69f4fe
SSDEEP

384:alNclfRevYnSDHXbou5HWuDRjX33Svp36Yg3nVMpdHrBgWCAvZet8c0v:dEYnSDHXlHTRmRqYg3nQhp5vZW9

Score

N/A

Malware Config

Signatures

Files

854e11639407127de9046cc80db025b450ceb0a568e33e890981282ff4bb4e93
.exe windows x86

7b7a85ee22ec2a7b46aa56030277fbbe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwMapViewOfSection
ZwCreateSection
RtlInitUnicodeString
_wcsnicmp
wcslen
swprintf
wcscat
wcscpy
_stricmp
strncpy
_except_handler3
ExFreePool
ExAllocatePoolWithTag
ZwUnmapViewOfSection
MmGetSystemRoutineAddress
PsGetVersion
strncmp
_strnicmp
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
ObfDereferenceObject
ObQueryNameString
_snprintf

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 576B - Virtual size: 550B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ