271b00bdb6b3d6cd0287f2a5d29cc1374b8909ba9ebe3f789f2656fbfc0f731f

Sharing

Copy URL

Twitter E-mail

General

Target

271b00bdb6b3d6cd0287f2a5d29cc1374b8909ba9ebe3f789f2656fbfc0f731f
Size

23KB
MD5

05bb66b6e70a24db99654f1810bb872f
SHA1

2410eeea3d39fda837c7dca4514555df5b0359da
SHA256

271b00bdb6b3d6cd0287f2a5d29cc1374b8909ba9ebe3f789f2656fbfc0f731f
SHA512

39f4ed7cffbdc58f2755734c13f910883cd5b7c7278f792af4efedfb4facc5393cf175fba459dd927442eb375691af1478e1540fe35d65a707ec912f7513a522
SSDEEP

384:87rODtdYm+oBhaphZ6YjsoFPBo/PcBuSfC0lmNJEftMRAFR3i6h4Uxvd9Eg5s:8300K8phZ6Ask5EUgSftmNJEftMRA33P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
271b00bdb6b3d6cd0287f2a5d29cc1374b8909ba9ebe3f789f2656fbfc0f731f

Files

271b00bdb6b3d6cd0287f2a5d29cc1374b8909ba9ebe3f789f2656fbfc0f731f
.exe windows x86

ecc65d0c0f7deb6513c1bec5b871763c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoGetDeviceProperty
MmUnmapIoSpace
ObfDereferenceObject
KeInitializeSpinLock
swprintf
MmMapIoSpace
IoGetDmaAdapter
WRITE_REGISTER_ULONG
READ_REGISTER_ULONG
WRITE_REGISTER_UCHAR
WRITE_REGISTER_USHORT
READ_REGISTER_UCHAR
READ_REGISTER_USHORT
ObReferenceObjectByHandle
KeTickCount
KeBugCheckEx
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memset
RtlCopyUnicodeString
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
KeSetEvent
ExFreePoolWithTag

hal

WRITE_PORT_ULONG
KfReleaseSpinLock
KfAcquireSpinLock
READ_PORT_ULONG

wdfldr.sys

WdfVersionBind
WdfVersionBindClass
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 445B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ecc65d0c0f7deb6513c1bec5b871763c

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 512B - Virtual size: 445B

.data Size: 512B - Virtual size: 2KB

PAGE Size: 6KB - Virtual size: 5KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 848B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 512B - Virtual size: 445B

.data
Size: 512B - Virtual size: 2KB

PAGE
Size: 6KB - Virtual size: 5KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 2KB - Virtual size: 1KB