c2593824a92515d4ee5bff2f023043d25d4058766c5d013020033436c927bd7f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c2593824a92515d4ee5bff2f023043d25d4058766c5d013020033436c927bd7f
Size

33KB
MD5

7ebc6a722c19e5e63bbfd4539f003090
SHA1

61778be6dfe08a2fb32a03aee54f49438d0b0ea4
SHA256

c2593824a92515d4ee5bff2f023043d25d4058766c5d013020033436c927bd7f
SHA512

702fdce987e4367c991899d3a8a2824d045efe7082f90092727059acb514a7cf6bc6aa18121408e799d3a36213e500dfe6a8894bf9bc9f278c5b75ff8e95083e
SSDEEP

768:o0yz9PkMpEIifI4IXyuQNTPknjFCz+wh:1g9PmpmyuQNTpz+

Score

N/A

Malware Config

Signatures

Files

c2593824a92515d4ee5bff2f023043d25d4058766c5d013020033436c927bd7f
.exe windows x86

c1280fd45c666bf6c68c36156beecfb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoCreateFile
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
KeDetachProcess
IoDeleteDevice
ZwTerminateProcess
ObOpenObjectByPointer
MmUnmapViewOfSection
ZwClose
RtlInitUnicodeString
MmIsAddressValid
PsLookupProcessByProcessId
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
PsGetVersion
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
KeAttachProcess
IofCompleteRequest

hal

KeGetCurrentIrql

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 640B - Virtual size: 581B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ