f471c86e2083fc4db45a48ed4744f8159ecb441d5c3bc59eecf23978aac12b8d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f471c86e2083fc4db45a48ed4744f8159ecb441d5c3bc59eecf23978aac12b8d
Size

625KB
MD5

9ec56ba6c9b02ddc8b4e2bb7ca429cc4
SHA1

75065431269adf5b4eb1f4923ba034c7ac818ceb
SHA256

f471c86e2083fc4db45a48ed4744f8159ecb441d5c3bc59eecf23978aac12b8d
SHA512

d3514abd90d533729d45c79d9e99f010e3c6919ce8bedffdc6119e96d552955c787cec6ff2b40ac2b7788c0bd3ef4e1b7bbff74143a3ced0b079e91945dad551
SSDEEP

12288:R5K2/58O13NNbhCXz5OgugWXqzS0uiUFGYgzjFN:R5K2KO137M4gjzS0ulFVgzj3

Score

N/A

Malware Config

Signatures

Files

f471c86e2083fc4db45a48ed4744f8159ecb441d5c3bc59eecf23978aac12b8d
.exe windows x86

5e4cb15aa3df8da982ed18ac40068dec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCreateKey
NtOpenProcessToken
NtCreateFile
NtClose
NtAdjustPrivilegesToken
NtDeleteFile
NtWriteFile
RtlInitUnicodeString
NtSetSecurityObject
NtTerminateProcess
NtSetValueKey
NtQuerySecurityObject
NtReadFile
RtlQueryEnvironmentVariable_U
NtQueryInformationToken
RtlUnwind
wcscpy

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.cdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ