ad621d993af5708c8bddd1fc96af015b8080ff8b4c1000637474bdff12f52ee9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad621d993af5708c8bddd1fc96af015b8080ff8b4c1000637474bdff12f52ee9
Size

8KB
MD5

1e2bc13d2368d6e459c9f2a71a9a7a4c
SHA1

e36808f181b497bc39d12e654cbc87d3f25ddd9c
SHA256

ad621d993af5708c8bddd1fc96af015b8080ff8b4c1000637474bdff12f52ee9
SHA512

c2dcaaa5f297d6701f4297e6a9886e0032e63233e83a96b6e925fd1cf6d0d993db57feb39d0de77f264b2185516ee76a4ade3404048bc1686b31748ef4237474
SSDEEP

96:D8xOpU7shNmCIoCQPFVqKVGhZja20aE7oVjK4b2ZBiLlxQgOg1gDuW49bWyCanHK:DBqQPD0L677o9NbQiLlC9wkHeK

Score

N/A

Malware Config

Signatures

Files

ad621d993af5708c8bddd1fc96af015b8080ff8b4c1000637474bdff12f52ee9
.exe windows x86

24d7b61038346703eefbef5ed4ffea85

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePool
KeDelayExecutionThread
ZwFlushKey
ZwSetValueKey
ZwClose
ExAllocatePoolWithTag
ZwQueryValueKey
ZwCreateKey
ZwOpenKey
RtlInitUnicodeString
DbgPrint
ZwCreateFile
PsTerminateSystemThread
PsCreateSystemThread

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 384B - Virtual size: 364B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 608B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ