c3174628a61a510d0429f7cda2cb2eb42669e0754636c16bfb154f343139a17d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c3174628a61a510d0429f7cda2cb2eb42669e0754636c16bfb154f343139a17d
Size

4KB
MD5

4b564e43aedafc04db22b3f18cdf023b
SHA1

81b18efc6bf756d0216459063e503ef1ffc9e18d
SHA256

c3174628a61a510d0429f7cda2cb2eb42669e0754636c16bfb154f343139a17d
SHA512

87620b47a194b171a7b88715de49fe95e6376cff9d25df97c484046763c601d322b084ca34d746775a938e244b539d27e5eaadff9252d3c7b9b649e9d3d47cac

Score

N/A

Malware Config

Signatures

Files

c3174628a61a510d0429f7cda2cb2eb42669e0754636c16bfb154f343139a17d
.exe windows x86

c810d6b11564f95b52f91eb72b4ef277

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
MmMapLockedPagesSpecifyCache
IoGetDeviceObjectPointer
RtlInitUnicodeString
ObfDereferenceObject
KeInitializeEvent
ExAllocatePoolWithTag
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
wcscpy
KeDelayExecutionThread
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ExFreePoolWithTag

hal

KeGetCurrentIrql

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 562B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ