f4f9b9bcdfa47d93ac8992ab023cd72c1c63a4e9a7b10bdb7d2407dd8b8867f8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f4f9b9bcdfa47d93ac8992ab023cd72c1c63a4e9a7b10bdb7d2407dd8b8867f8
Size

18KB
MD5

d6d0aee5b75b395b4aae19f748f43c54
SHA1

06df087f99a308fef14c10acaed9da1d7ee63672
SHA256

f4f9b9bcdfa47d93ac8992ab023cd72c1c63a4e9a7b10bdb7d2407dd8b8867f8
SHA512

dc65da7d1c3105cdf0837395ac2e3156359ee967fc2bb7132215fcc911cd2f366636b7518d796588097890feee665305662eb73382213063aa0b409840dab11c
SSDEEP

384:cK0yS72WSzCCujeJBAjMHsIpiKnE4T7pYF4u3UVaDwBt3oZSbMtGPSxIOkCWhF2y:8CWEsIpiKE4T7pYF4u3UVaDwBt3oZSbX

Score

N/A

Malware Config

Signatures

Files

f4f9b9bcdfa47d93ac8992ab023cd72c1c63a4e9a7b10bdb7d2407dd8b8867f8
.exe windows x86

5c7aea68e851a44b0a49cd139ea3f7dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strlen
ZwClose
ExFreePool
ZwWriteFile
strcat
memset
ExAllocatePoolWithTag
ZwCreateFile
RtlInitUnicodeString
strstr
_stricmp
strncmp
IoGetCurrentProcess
_except_handler3
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
wcscat
wcscpy
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
_snwprintf
ZwEnumerateKey
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
_wcsnicmp
wcslen
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 992B - Virtual size: 976B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ