0f010ced41295d4a9706b04baa98d194cbf9d9bcf266515499fb5534531b7f3d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f010ced41295d4a9706b04baa98d194cbf9d9bcf266515499fb5534531b7f3d
Size

14KB
MD5

73f070253d9045f07224adcf0027d810
SHA1

e0d8a572f6c5f8d0a2390a68f6df22818023ff67
SHA256

0f010ced41295d4a9706b04baa98d194cbf9d9bcf266515499fb5534531b7f3d
SHA512

273212d78d039d61bf8ba4eb265f14e3b0eb4338d7e3f60b7276b591238d7cac71fd6a325f1873dd5d9b53808e15f030b3a776037460e6cafdbad83be49b37d6
SSDEEP

192:qdWXP3pexnHdnSFNfCx9nTcUgcjXbwr6Bwq/:qdWXP3pwHdn6Nf29nT5RrTBw

Score

N/A

Malware Config

Signatures

Files

0f010ced41295d4a9706b04baa98d194cbf9d9bcf266515499fb5534531b7f3d
.exe windows x86

ee06518f6fdf76ddee9bf1f4704106b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnmapLockedPages
ZwMapViewOfSection
PsGetVersion
sprintf
tolower
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
ObfDereferenceObject
ZwAllocateVirtualMemory
RtlInitUnicodeString
ObReferenceObjectByHandle
MmSectionObjectType
ZwPulseEvent
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
_except_handler3

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 570B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 384B - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ