e7880f06fd5e391d7bbcb56f42a94f88ccffa0de40069531edcd7dbb51f0be8e | Triage

Sharing

General

Target

e7880f06fd5e391d7bbcb56f42a94f88ccffa0de40069531edcd7dbb51f0be8e
Size

2KB
MD5

f39a66032e1175d02bbaf5b73ac80f01
SHA1

b0987b45f50215ce541108f14e02570df695b6f5
SHA256

e7880f06fd5e391d7bbcb56f42a94f88ccffa0de40069531edcd7dbb51f0be8e
SHA512

abd124b15e55e62cbc5fc41c62806fe21bd306be3bede6f5a60af3856a43d7cd6ebe540c6f32bbbb7c71687c9147043183c43ca109e0e67b70475d5d5cb973fa

Score

N/A

Malware Config

Signatures

Files

e7880f06fd5e391d7bbcb56f42a94f88ccffa0de40069531edcd7dbb51f0be8e
.exe windows x86

246265172e81eccd7f1af4752e7248ee

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwClose
strncpy
RtlUnicodeStringToAnsiString
ObQueryNameString
IofCompleteRequest
KeDetachProcess
ObfDereferenceObject
ObReferenceObjectByHandle
KeAttachProcess
PsLookupProcessByProcessId
RtlFreeAnsiString
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 576B - Virtual size: 562B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 160B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ