68311ba409c137b817411a258b96b887ed3949b6b220cd7ffd69ab564605c295 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68311ba409c137b817411a258b96b887ed3949b6b220cd7ffd69ab564605c295
Size

4KB
MD5

dc3a275183df139601e7c20b9fac7387
SHA1

a7f73092e8a69db49aa62e5dab52c0f2b0cdcf06
SHA256

68311ba409c137b817411a258b96b887ed3949b6b220cd7ffd69ab564605c295
SHA512

2203d4c541e464cb6c521aa32a803ba77ad6a95e1cd5fd8a7b5d39690202f96076d1e9f34ff8305402a082f38803d2f8903f2333bd08dec0d45e3e44ce14a477
SSDEEP

96:H6B/A0Xp8bNGH3WbvSlzvLaid286SJywyObuXzl1:H6B6xGXWbvYzBJgOKX

Score

N/A

Malware Config

Signatures

Files

68311ba409c137b817411a258b96b887ed3949b6b220cd7ffd69ab564605c295
.exe windows x86

b1c1318232c37d00623108c12b786682

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncmp
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoGetCurrentProcess
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
_snprintf
PsGetCurrentProcessId
DbgPrint
ExFreePoolWithTag
ExAllocatePoolWithTag
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 243B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 518B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ