d078fe50f3dc4b8684df69f9d36b04e66908b580a314e7f08a11a9189b119978 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d078fe50f3dc4b8684df69f9d36b04e66908b580a314e7f08a11a9189b119978
Size

14KB
MD5

0de52f103c99d5523460675ad40f46be
SHA1

810de1cd856b3254c6261667a859f456bd33094b
SHA256

d078fe50f3dc4b8684df69f9d36b04e66908b580a314e7f08a11a9189b119978
SHA512

ec364dcb1fb40866c2fc8c0769f0811426c02b3b488d1434c6d759c4c92af13ec3dfe6f866cb2b9224078c48d4c641fcf5944435f8197884d0d58201e65e53ef
SSDEEP

192:NLeIw9WU2/41gqYhfX02MihE6FVvCdwJ9lc/FdVai1DWWZ8oFW:mo/4M1XV5D7vKwBc/FdVai1aWZ8oFW

Score

N/A

Malware Config

Signatures

Files

d078fe50f3dc4b8684df69f9d36b04e66908b580a314e7f08a11a9189b119978
.exe windows x86

c8c15557f9c4fc56d8265da6733a8672

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObfDereferenceObject
ObfReferenceObject
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
PsLookupProcessByProcessId
IoCreateSymbolicLink
IoCreateDevice
_except_handler3

Sections

.text
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 189B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 128B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ