c6e5438b3fddb643c0856126d2090ccf7c14b1e71dccf9a78935a5ae9c37bd23 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c6e5438b3fddb643c0856126d2090ccf7c14b1e71dccf9a78935a5ae9c37bd23
Size

6KB
MD5

e2dbd41b5751b1c55910f1111701881b
SHA1

39a14f39c0c7fc53cd5905daf0aff44f6b30fe48
SHA256

c6e5438b3fddb643c0856126d2090ccf7c14b1e71dccf9a78935a5ae9c37bd23
SHA512

213e2daf28621ac81bc9f2ff2a16fe3c1427063e063a6be1316da21b933e3c063943488e043da35a874a8d51129c059e7887b26b1576fe75937363dd640391d3
SSDEEP

96:C2ni7MwvFAv6FzwS4X6P1If9nnOFF8JgXh+SMCT+l3SBpAKtMz5R:daMF6F8bf9nuikhdiZKKR

Score

N/A

Malware Config

Signatures

Files

c6e5438b3fddb643c0856126d2090ccf7c14b1e71dccf9a78935a5ae9c37bd23
.exe windows x86

bb987107c12db4043bce620809ac5191

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
ObOpenObjectByPointer
_except_handler3
IoCreateFile
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmUnmapViewOfSection
ZwClose
ZwSetValueKey
wcslen
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
ZwCreateKey
RtlInitAnsiString
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IofCompleteRequest
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
PsLookupProcessByProcessId

hal

KeGetCurrentIrql

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ