b02e939ed1f2a4af90b171eb7f0f4c71d024d106e6950132440c092d1e6f0cdf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b02e939ed1f2a4af90b171eb7f0f4c71d024d106e6950132440c092d1e6f0cdf
Size

6KB
MD5

c19dad4f21b9ffff7d4358b933c17522
SHA1

5285f2fdb23b40c8ec71d2995a0ff66da99279bb
SHA256

b02e939ed1f2a4af90b171eb7f0f4c71d024d106e6950132440c092d1e6f0cdf
SHA512

d91fafbf1e76f7e3b1755ba0e9e34585266926a8d611b5efa011973fe33e8a41a2de80de526dd41f08d1327e82bb2cc7d4d503ab694e9ce132bce17e19c47f97
SSDEEP

96:fW7NYNNLYcWI4NQSRATFPKJM1nwDidHFifyOYR0KFaTGmyl+cApxppVSz:f6KNKIGQ3MMRwifiq/RXW/xH

Score

N/A

Malware Config

Signatures

Files

b02e939ed1f2a4af90b171eb7f0f4c71d024d106e6950132440c092d1e6f0cdf
.dll windows x86

e610606a11a87777a4b7b6452a47757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 132B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ