99025ae16c3beaa8f3a40dcf22e0bb843618f35f7f6ffaa30a5217431d53130b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

99025ae16c3beaa8f3a40dcf22e0bb843618f35f7f6ffaa30a5217431d53130b
Size

21KB
MD5

fa48c0f0f5b1d270fbde16824f16e186
SHA1

9764cb3e8d7426dc01ffe9b997b5439aa1e55642
SHA256

99025ae16c3beaa8f3a40dcf22e0bb843618f35f7f6ffaa30a5217431d53130b
SHA512

834ba9d8adc820b3463529d6bfc10d2d579acf58448ec9436291a2903caa53a5f3fb50380ae94bc047276426495cc8fb90362df39f4586164a50c8e4d79e8e30
SSDEEP

384:ZWz8LHfLjZjv+AJ20qL0eWcCOTZ41OzHrB9vG/ZrrYEiocMUXEoZ:ozEHfHZjVE0qLDI0y/ARL

Score

N/A

Malware Config

Signatures

Files

99025ae16c3beaa8f3a40dcf22e0bb843618f35f7f6ffaa30a5217431d53130b
.exe windows x86

b1be4f73a94948bfef618ae85626d0f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwCreateFile
ZwEnumerateKey
ZwSetValueKey
ZwClose
ZwOpenKey
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
IoRegisterDriverReinitialization
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
MmIsAddressValid
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlAnsiStringToUnicodeString
PsGetVersion
_wcslwr
wcsncpy
ZwUnmapViewOfSection
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 640B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ