35e5e17772fba61500bd12840aa8e9c7af6c65abff1884198af5ec8d35a8ce1f

General

Target

35e5e17772fba61500bd12840aa8e9c7af6c65abff1884198af5ec8d35a8ce1f
Size

27KB
MD5

a966b7e110b4c6d93b4038ce8739d5e2
SHA1

d0b7daa9285ee2a8f237ab7f95aa88a4f4e8dd08
SHA256

35e5e17772fba61500bd12840aa8e9c7af6c65abff1884198af5ec8d35a8ce1f
SHA512

2f41a291bab1ad8cf473367e7ca8e3b709ab74232dc53cfeee64e6be0e5e750c5dfb150ddf6b71a157def4fff1ce29b164f2c2250e414670a0e72fce6427fd5c
SSDEEP

384:sGWsVVL98arJfp06F3w7gHTHhk4X7oq8X1kY0HE+6qf7p+8/Sdge26dnzqTw:sjsTrLf36clVX7oeYCEbqjQDmGdk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35e5e17772fba61500bd12840aa8e9c7af6c65abff1884198af5ec8d35a8ce1f

Files

35e5e17772fba61500bd12840aa8e9c7af6c65abff1884198af5ec8d35a8ce1f
.exe windows x64

46aaf05609db03465c872e132711be20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlCompareMemory
IoWMIRegistrationControl
swprintf
IoGetDeviceProperty
ObfDereferenceObject
MmUnmapIoSpace
MmMapIoSpace
IoGetDmaAdapter
MmGetSystemRoutineAddress
KeReleaseSpinLock
KeSetEvent
ObReferenceObjectByHandle
ExEventObjectType
KeBugCheckEx
RtlCopyUnicodeString
ExFreePoolWithTag
IoWMIWriteEvent
ExAllocatePoolWithTag
KeAcquireSpinLockRaiseToDpc
RtlInitUnicodeString

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46aaf05609db03465c872e132711be20

Headers

File Characteristics

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 1024B - Virtual size: 1020B

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 636B

PAGE Size: 6KB - Virtual size: 6KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 896B

.reloc Size: 512B - Virtual size: 96B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 1024B - Virtual size: 1020B

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 636B

PAGE
Size: 6KB - Virtual size: 6KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 896B

.reloc
Size: 512B - Virtual size: 96B