926af1bd0904c3efd2eb7d2f42b99c0362c6b78b643ebb308bd06034fe2d510b | Triage

Sharing

General

Target

926af1bd0904c3efd2eb7d2f42b99c0362c6b78b643ebb308bd06034fe2d510b
Size

4KB
MD5

f39444c62face458031c6c1d5072ad82
SHA1

3c9747dd5e643c3a6a7cd806b603fe6e01756325
SHA256

926af1bd0904c3efd2eb7d2f42b99c0362c6b78b643ebb308bd06034fe2d510b
SHA512

3a93541908ec346ea3dd84db15feba892eff5ce14618ad83d07f353066e20cfd2603494d61ed4718d8bb8c6870f8184613a9665c0eece60cb88900b8c9a56b06

Score

N/A

Malware Config

Signatures

Files

926af1bd0904c3efd2eb7d2f42b99c0362c6b78b643ebb308bd06034fe2d510b
.dll windows x86

084d5253a6e9b0d181b8f7c9ec09f4fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ZwClose
ZwUnmapViewOfSection
ExAllocatePoolWithTag
ZwMapViewOfSection
ZwOpenSection
RtlInitUnicodeString
memcpy
ObfDereferenceObject
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine

Sections

.text
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ