d11a8188adf1f21565a438c4d8512ee850554ef66c18cc5424e703149baf0e06 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d11a8188adf1f21565a438c4d8512ee850554ef66c18cc5424e703149baf0e06
Size

12KB
MD5

2ce00d9c2a0606db21e6f088e897c98c
SHA1

78d112c6347aaea65078fd6b564ffaa82efc5664
SHA256

d11a8188adf1f21565a438c4d8512ee850554ef66c18cc5424e703149baf0e06
SHA512

72dfa7c5a259d50ffc3cd75bd9fd2418e33dec0f5dbf81822190a54ee5f5a7f979cf09c391bb2a70afc3e93cfe7f4197a9de156b9971cb2e73b5c3fd9661c4cd
SSDEEP

192:JpxtCPr8Awe6tqjNWdrR7l8/YfTtTLhqkmBwqSuG:JncD2ZtYi+YLtTLDmBwmG

Score

N/A

Malware Config

Signatures

Files

d11a8188adf1f21565a438c4d8512ee850554ef66c18cc5424e703149baf0e06
.exe windows x86

ee708decca95f815d6ce34421d1a3e2d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoFreeMdl
MmUnmapLockedPages
ZwMapViewOfSection
PsGetVersion
_stricmp
IoGetCurrentProcess
tolower
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
ObfDereferenceObject
ZwAllocateVirtualMemory
RtlInitUnicodeString
ObReferenceObjectByHandle
MmSectionObjectType
ZwPulseEvent
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 598B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ