f0c67ca4597ebf163243a58a0c5be4427948d616c1de4e4a1aabb84a08b58862 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0c67ca4597ebf163243a58a0c5be4427948d616c1de4e4a1aabb84a08b58862
Size

378KB
MD5

17138fac8b1c201539ae89119727e25a
SHA1

2ef43834a186ca1edafa475c4de5859170ddc870
SHA256

f0c67ca4597ebf163243a58a0c5be4427948d616c1de4e4a1aabb84a08b58862
SHA512

47139d8004eb8b825520d920f94f7e1edf5199ee749f2444ded9aa47f3acd667866aee26f8d631d5aa714c74767ff94a5246aa2fe21ff3d452737bddb5f6c1d6
SSDEEP

6144:VzDOqbD8k9kNIzk16ffkurOpbDIgFhXYWXMHJyUooBMpacpVnYrZVxWn60u3vzNf:NDO2D8Q2KJPcniWgdQsyDS

Score

N/A

Malware Config

Signatures

Files

f0c67ca4597ebf163243a58a0c5be4427948d616c1de4e4a1aabb84a08b58862
.exe windows x86

ddf97d317ffda502d53ae4f61f7a4ee2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlGetGroupSecurityDescriptor
IoFreeIrp
InterlockedExchangeAdd
PsReturnPoolQuota
ExAllocatePoolWithTagPriority
PsChargeProcessPoolQuota
RtlCopyUnicodeString

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 234B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ