b1c73ae97c1bac2d822c8e4bfcc37b15644a780ec8904974a8239f312a1049d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b1c73ae97c1bac2d822c8e4bfcc37b15644a780ec8904974a8239f312a1049d8
Size

4KB
MD5

34b58d3df160986141117799dd8920c9
SHA1

67c3725081faa5d20d7217ee79151867f3703f81
SHA256

b1c73ae97c1bac2d822c8e4bfcc37b15644a780ec8904974a8239f312a1049d8
SHA512

1289e14c83ff8da9680d955101fbca7301666a10714c22bad0b146d15ce09aa53e04611d5380548c426ee8162482f31e38e0e55c115fa9aac822c32cce1678f0
SSDEEP

96:nqPJXXtkBNphZSoxHvjjtpTJVVkz51g2R:eNwphpvVpTdkkc

Score

N/A

Malware Config

Signatures

Files

b1c73ae97c1bac2d822c8e4bfcc37b15644a780ec8904974a8239f312a1049d8
.exe windows x86

5bd98060da2f7c1b56d3491ad4f5f3ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeServiceDescriptorTable
ZwQueryDirectoryFile
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
RtlFreeAnsiString
DbgPrint
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
RtlInitAnsiString
ExFreePoolWithTag
ObfDereferenceObject
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlVolumeDeviceToDosName
ObReferenceObjectByPointer
ExAllocatePoolWithTag
ObReferenceObjectByHandle
strncpy
IoGetCurrentProcess
_strnicmp
strrchr
ProbeForWrite
ProbeForRead
IoCreateSymbolicLink
IoCreateDevice
_except_handler3

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 263B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 896B - Virtual size: 796B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ