b8a04163b93022e1f6e54bd9440991acfbb9cb1a8c2a5c3931f7397f125eb5b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b8a04163b93022e1f6e54bd9440991acfbb9cb1a8c2a5c3931f7397f125eb5b7
Size

6KB
MD5

da9adc9602cd7909f6a9154b1dce0111
SHA1

c4341172cd5c0bf96b67796d25a15ddc416ed9bd
SHA256

b8a04163b93022e1f6e54bd9440991acfbb9cb1a8c2a5c3931f7397f125eb5b7
SHA512

6b9d69b38bfdf4d2334bd6ead839e1383ec259f83df7600d81374e054654da098f07d15f0c97375275c10691ed38a9bb9e3e8ba19ee1d8fb602bab11f92c83b5
SSDEEP

48:4qvqOoNkD14XedFC/8FsPylBu4HTQxNnvzHJetlUrUVTgFxhRVBqN+TE9vCBajM6:cI42FlgcA4sHndetl/crPqjpE2qv3O

Score

N/A

Malware Config

Signatures

Files

b8a04163b93022e1f6e54bd9440991acfbb9cb1a8c2a5c3931f7397f125eb5b7
.exe windows x86

790a705bb6e01a5ec06e60aeca34cb54

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
ExFreePoolWithTag
KeUnstackDetachProcess
ProbeForRead
KeStackAttachProcess
ExAllocatePoolWithTag
PsLookupProcessByProcessId
_except_handler3
ProbeForWrite
MmIsAddressValid
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 554B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ