aeed9ebf544cb92d2843e3e08182a4b63d1e13d34ed4957a4f7ada667a8148bc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aeed9ebf544cb92d2843e3e08182a4b63d1e13d34ed4957a4f7ada667a8148bc
Size

46KB
MD5

db3971105a0bb3a5f79010cdd1fe6e0c
SHA1

50e6db19fd0d4677bc1b383a8175f3b47db16fb9
SHA256

aeed9ebf544cb92d2843e3e08182a4b63d1e13d34ed4957a4f7ada667a8148bc
SHA512

073c1444241b6232f8b5cc148dcaa3b16a7eef62aeeccd870da82ac626fef0d3c4348527383f184ae13daedc944203cbe22ff9b55ed5eaeea217036f49a8eabc
SSDEEP

384:s0gOIAMWVjml1zj9AjKPOk0vkzRh+BV22KTqJhhjwve/J6v0TCwjrusOWLPbvK+5:Vgxk8lssJMSOdz1ccBFMYCuen1D

Score

N/A

Malware Config

Signatures

Files

aeed9ebf544cb92d2843e3e08182a4b63d1e13d34ed4957a4f7ada667a8148bc
.exe windows x86

3021324dd951ab74acdbdee9f80df426

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

MmIsAddressValid
RtlInitUnicodeString
MmGetSystemRoutineAddress
ZwCreateFile
ZwSetValueKey
ZwClose
ZwOpenKey
ZwEnumerateKey
PsSetCreateProcessNotifyRoutine
wcscat
wcscpy
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
PsGetVersion
_wcslwr
wcsncpy
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
swprintf
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
IoRegisterDriverReinitialization
ZwUnmapViewOfSection
ZwCreateKey
RtlAnsiStringToUnicodeString

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 928B - Virtual size: 900B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 704B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ