f9e9807b54f8154e7578dbaf8905e3a053ce60b475ceb1ca3074ecc19e74c305 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9e9807b54f8154e7578dbaf8905e3a053ce60b475ceb1ca3074ecc19e74c305
Size

11KB
MD5

d18fce5feacf7513e564b02579b46de5
SHA1

a13815cfb66a34e0a2c7ae653ca47abf2ec80dd1
SHA256

f9e9807b54f8154e7578dbaf8905e3a053ce60b475ceb1ca3074ecc19e74c305
SHA512

29b42f9d4e7f109a7a93f7f35dd8db50baeaf7a413a3dfd9050c9c42fb87a39c6bbadfcf9fcd3e00040396ec4179973fdc35af8091fd1ab0978976c745b31cea
SSDEEP

96:66jmqG1tbHG3o6t9UegzQARvbolnuVTxGr7et5TMXb4hcwxEpLXfoqZ+:nG19GnlgcARvMlnuNxk6tiAEBwq

Score

N/A

Malware Config

Signatures

Files

f9e9807b54f8154e7578dbaf8905e3a053ce60b475ceb1ca3074ecc19e74c305
.exe windows x86

ee708decca95f815d6ce34421d1a3e2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnmapLockedPages
ZwMapViewOfSection
PsGetVersion
_stricmp
IoGetCurrentProcess
tolower
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
ObfDereferenceObject
ZwAllocateVirtualMemory
RtlInitUnicodeString
ObReferenceObjectByHandle
MmSectionObjectType
ZwPulseEvent
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
_except_handler3

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 223B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 598B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ