8768ff6b771f2dee50f60424eff778b872d093394a688342a99927724b171f05 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8768ff6b771f2dee50f60424eff778b872d093394a688342a99927724b171f05
Size

16KB
MD5

2cb6f42cd100fcad1b1d32431f134ac0
SHA1

aa008d3f4ea435d9d4bee607060fb080ede5d019
SHA256

8768ff6b771f2dee50f60424eff778b872d093394a688342a99927724b171f05
SHA512

02075f6b23542961c35c8e82af751a665a7125d41fc8cbd9ba1ff8184fa8dba313b8321c81278a8f3259e9106e125190bab15f3e46234c2aed9b62e6ec9790bb
SSDEEP

384:F8iG3B9fp6rVYrs/dp8oQxH653YPhbxTr0CNb7BOPjOZK9ys:o2Yrs1puVhbBHNb15W

Score

N/A

Malware Config

Signatures

Files

8768ff6b771f2dee50f60424eff778b872d093394a688342a99927724b171f05
.exe windows x86

cfd699d0ba646297b082df8082549e2c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memcpy
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
PsTerminateSystemThread
IofCompleteRequest
PsGetVersion
KeServiceDescriptorTable
ObfReferenceObject
IoCreateSymbolicLink
ObfDereferenceObject
_except_handler3

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ