8bdae18612f1a5df58de0d84a5f06a18d423e722fc828f9e13f3ee047e985bd7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8bdae18612f1a5df58de0d84a5f06a18d423e722fc828f9e13f3ee047e985bd7
Size

28KB
MD5

0d3efbee52fdfe04374aa2fac2d1b740
SHA1

700da6c3b0b6d7eaf74d1eabd35067d1583440a0
SHA256

8bdae18612f1a5df58de0d84a5f06a18d423e722fc828f9e13f3ee047e985bd7
SHA512

2dea4037fde0bd897d99e3443986d04ad80c52974ae891cb188e6470187966a773ca2842158807c346c4d5f0729947155cbc65a8085755c7580654fb34190d81
SSDEEP

768:deXl49XqZ4GdpKhzhmw/5tiSYfTry1QshM:deXS96aV5gSuSG

Score

N/A

Malware Config

Signatures

Files

8bdae18612f1a5df58de0d84a5f06a18d423e722fc828f9e13f3ee047e985bd7
.exe windows x86

2eadf96e5422dd5a81c52e013a7e77da

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
RtlInitUnicodeString
RtlCopyUnicodeString
MmIsAddressValid
wcscat
swprintf
wcscpy
MmGetSystemRoutineAddress
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
_stricmp
strncpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
_strnicmp
_wcsnicmp
wcslen
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
_except_handler3
RtlCompareUnicodeString
ObfDereferenceObject
ObQueryNameString

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 704B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ