dce50e928ad1e2841e25cde080b408163f0b1d94cded039ef1ff690224be0cae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dce50e928ad1e2841e25cde080b408163f0b1d94cded039ef1ff690224be0cae
Size

3KB
MD5

fb393ba3d454e4e8ec36d8caa1c74879
SHA1

e75eee3a8450a59490cae539dd2663e1508ceb0b
SHA256

dce50e928ad1e2841e25cde080b408163f0b1d94cded039ef1ff690224be0cae
SHA512

9b605d07d810af5b9dc1af20b9121bd402b91e964573ddf39edd9cc3f6e8609b1b9345c6ac6e19fdea7814202df3136605d796ea77dde83030b57817776f910b

Score

N/A

Malware Config

Signatures

Files

dce50e928ad1e2841e25cde080b408163f0b1d94cded039ef1ff690224be0cae
.exe windows x86

fe778f654895e3b8ef796e61eefcf7f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeServiceDescriptorTable
ZwQueryDirectoryFile
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
RtlFreeAnsiString
DbgPrint
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlInitAnsiString
_strnicmp
strncpy
IoGetCurrentProcess
ProbeForWrite
ProbeForRead
IoCreateSymbolicLink
IoCreateDevice
_except_handler3

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 215B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 384B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 538B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ