83d0d9966cd4c3e54f85618791f00b335648adf4c05d3a4d5cc1733cad1bc64b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

83d0d9966cd4c3e54f85618791f00b335648adf4c05d3a4d5cc1733cad1bc64b
Size

12KB
MD5

e03aa0404046e68254e08a847195a4c0
SHA1

f6c1e8cf2277d3e41b94d8b6cbdbc759d0062bb1
SHA256

83d0d9966cd4c3e54f85618791f00b335648adf4c05d3a4d5cc1733cad1bc64b
SHA512

5c1f5c21c0b75fb68506842cd99e6c92b66169ef1a4e650a05d6548d3545223b45a8a310c70e87a3a1d763d4e110367baf28b8ef1c4348c588fb5adbb3ed50f5
SSDEEP

192:MOSpxt2dvBuGB+9pQM1d75sHC2tIW/dBwq:M5nsBuGBeuttl/dBw

Score

N/A

Malware Config

Signatures

Files

83d0d9966cd4c3e54f85618791f00b335648adf4c05d3a4d5cc1733cad1bc64b
.exe windows x86

ee708decca95f815d6ce34421d1a3e2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnmapLockedPages
ZwMapViewOfSection
PsGetVersion
_stricmp
IoGetCurrentProcess
tolower
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
ObfDereferenceObject
ZwAllocateVirtualMemory
RtlInitUnicodeString
ObReferenceObjectByHandle
MmSectionObjectType
ZwPulseEvent
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 206B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 598B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ