db34aea8f430a576fd9fcae1a85a925fab4e0e3355cf7c43a52ca252b812930b

General

Target

db34aea8f430a576fd9fcae1a85a925fab4e0e3355cf7c43a52ca252b812930b
Size

53KB
MD5

c489da37e92545c2d2640a50d47f2619
SHA1

3774607d013869535b456946eac3825f866fb4d1
SHA256

db34aea8f430a576fd9fcae1a85a925fab4e0e3355cf7c43a52ca252b812930b
SHA512

bb98644b191ea6183e24c7952df83c29c0340b750089437de9edae8c58bb39e3d94a0e243f82a30ac59b3ff00bbecc28e146833b5c341fc1c671385beb89d92e
SSDEEP

1536:b5jduSbqI5CY1zoBRKRs1j+nVWnI8olcSXWYFMSEzY:ljMnIEY1zoBRKRs1j+nVWnI8olcSXWYR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db34aea8f430a576fd9fcae1a85a925fab4e0e3355cf7c43a52ca252b812930b

Files

db34aea8f430a576fd9fcae1a85a925fab4e0e3355cf7c43a52ca252b812930b
.exe windows x64

36fd137259943a11e5d7e460bc868746

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

RtlCompareUnicodeString
KeDelayExecutionThread
MmIsAddressValid
PsRemoveLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutine
ObfDereferenceObject
PsCreateSystemThread
RtlInitUnicodeString
IoGetCurrentProcess
KeStackAttachProcess
ZwAllocateVirtualMemory
PsGetProcessExitStatus
PsLookupProcessByProcessId
PsGetProcessImageFileName
ObReferenceObjectByName
PsSetCreateProcessNotifyRoutine
IoDriverObjectType
PsTerminateSystemThread
KeUnstackDetachProcess
__C_specific_handler
ZwQuerySystemInformation
RtlFindExportedRoutineByName
ExAllocatePoolWithTag
ExFreePoolWithTag
ProbeForRead
RtlRaiseException
KeBugCheckEx

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36fd137259943a11e5d7e460bc868746

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 43KB - Virtual size: 43KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 416B

.pdata Size: 2KB - Virtual size: 1KB

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

.text
Size: 43KB - Virtual size: 43KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 416B

.pdata
Size: 2KB - Virtual size: 1KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B