b3d5358c28bce8531794e29aeb3b455f0ba67be9fa739ce272a64a04fdeb0c6b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b3d5358c28bce8531794e29aeb3b455f0ba67be9fa739ce272a64a04fdeb0c6b
Size

16KB
MD5

3c7af17a7ab62a9e7eda8aa1beb35465
SHA1

44b57cb445977bed8a2220cdf690924669317d8b
SHA256

b3d5358c28bce8531794e29aeb3b455f0ba67be9fa739ce272a64a04fdeb0c6b
SHA512

0711f08004c830f2de6e62e4843ebc860d19abdc11d3eda0dd29a54213d1765c6bca78251b2ea95ecb560fc831bb8756005d560e6b2b1b395bd05e8ba21717cd
SSDEEP

192:udjpQE6Fa1OOkef4R80mYK/rOUyjh8fO/e4bTSYhLIAjkrTfTM69os9h9bj:q7kmP7i8f2e4/XhdjkR9d/j

Score

N/A

Malware Config

Signatures

Files

b3d5358c28bce8531794e29aeb3b455f0ba67be9fa739ce272a64a04fdeb0c6b
.exe windows x86

c451b11bd62370850526d10bbdf1e2bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ZwClose
ObOpenObjectByPointer
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
MmUnmapViewOfSection
PsLookupProcessByProcessId
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 896B - Virtual size: 832B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 128B - Virtual size: 118B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ