c8cca6cc02de0f7af73ff9fae41d87be988c78857ae35e323dc2ad14879b161d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8cca6cc02de0f7af73ff9fae41d87be988c78857ae35e323dc2ad14879b161d
Size

21KB
MD5

e745804655d941f5c9459a2d8cd230c3
SHA1

fec86e704789ce11a518ac323f470135fc2cd174
SHA256

c8cca6cc02de0f7af73ff9fae41d87be988c78857ae35e323dc2ad14879b161d
SHA512

868c29c93ff6f8f4b09796e0f7d6f96558dcba49097593f34d9371a7977547d46f60f8524de49f8cf5d0af9dc5dba1868577458c61420af2114e93be835b9652
SSDEEP

384:Kos6tCjG0mzWO5S5vFJgIkVX4ljNSzgtIrCpDzw0gpvR1mTtuRu:WDngDKVbNtA

Score

N/A

Malware Config

Signatures

Files

c8cca6cc02de0f7af73ff9fae41d87be988c78857ae35e323dc2ad14879b161d
.exe windows x86

c30e4dce9e1c17fac9b6ac9367d06b41

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
ZwClose
ZwUnmapViewOfSection
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
ZwCreateFile
IoRegisterDriverReinitialization
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsGetVersion
_wcslwr
wcsncpy
strncmp
IoGetCurrentProcess
_wcsnicmp
RtlAnsiStringToUnicodeString
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 960B - Virtual size: 958B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 576B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ