eb8d691490146d212526beff788512cc94b66a9950c14b4eb726358cfde8128f | Triage

Sharing

General

Target

eb8d691490146d212526beff788512cc94b66a9950c14b4eb726358cfde8128f
Size

6KB
MD5

6cf7e692f83231169cbb574675c5980c
SHA1

515bb45d26c545ebac0b389c81370667a7b126e6
SHA256

eb8d691490146d212526beff788512cc94b66a9950c14b4eb726358cfde8128f
SHA512

b7a52c61bb0378c20d28a78d2d3f1fbb718ff1c13d94274ef5976c8f5a2723a67462e6669c63394e5569002de29cc63557819af655178510fb170766f1dfdb79
SSDEEP

48:qafDHt/AhUYrhMm/iNh98XUhoh0rIydeulNM0YezUNyaFbi8DYDV4zEoJhsbsO3r:9qhUEhMph9YUhsSrEezkZIaE/hZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb8d691490146d212526beff788512cc94b66a9950c14b4eb726358cfde8128f

Files

eb8d691490146d212526beff788512cc94b66a9950c14b4eb726358cfde8128f
.exe windows x64

ba7ae5b49efd548498aeb25214a7c807

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ZwClose
ZwOpenKey
ZwQueryValueKey
MmGetSystemRoutineAddress

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 318B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ