8941c5e56394397a89f46258e67e1d5c0fa3181a7565ee2b67409f94c124a315

General

Target

8941c5e56394397a89f46258e67e1d5c0fa3181a7565ee2b67409f94c124a315
Size

20KB
MD5

9b120c22fa625dc31b36e1901449c930
SHA1

d831513ad96644fd3c779871a7c9495d16e86088
SHA256

8941c5e56394397a89f46258e67e1d5c0fa3181a7565ee2b67409f94c124a315
SHA512

574bda3cc81fc7c5809e270345e4278acc1939b827409055894e5e0acc694a04382e178fc156721c46776a05dfbbdd8e67c00e3ecc456e64bc4fa3cee5662fe0
SSDEEP

384:IH+f/t8xG+RSotO3u8v0qIutuYKkBFHU4k4epTA90H8QZyV0j3T3YH9yVX1R4d:IH+f/tER9OPvmYYkBSt4eC9C8QZzjU9D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8941c5e56394397a89f46258e67e1d5c0fa3181a7565ee2b67409f94c124a315

Files

8941c5e56394397a89f46258e67e1d5c0fa3181a7565ee2b67409f94c124a315
.dll windows:5 windows x64

66546c6f2293f35ade72e797d3fc07b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeDelayExecutionThread
MmGetSystemRoutineAddress
RtlInitUnicodeString
KeInitializeEvent
PsRemoveLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutine
DbgPrint
PsSetCreateProcessNotifyRoutineEx
MmIsAddressValid
ObfDereferenceObject
IoThreadToProcess
PsLookupThreadByThreadId
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
RtlGetVersion
ZwClose
ZwQueryInformationFile
ZwCreateFile
_itoa_s
RtlTimeToTimeFields
ExSystemTimeToLocalTime
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
__C_specific_handler
atoi
strstr
strlen
_vsnprintf
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
KeSetEvent
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

66546c6f2293f35ade72e797d3fc07b2

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 18KB

.pdata Size: 512B - Virtual size: 456B

INIT Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 18KB

.pdata
Size: 512B - Virtual size: 456B

INIT
Size: 1KB - Virtual size: 1KB