156847a4e6787c40459126623139c849

General

Target

156847a4e6787c40459126623139c849
Size

52KB
MD5

156847a4e6787c40459126623139c849
SHA1

1225c751f769040132ccdc066b3cd138d5c3729c
SHA256

145ce94aad0e7b1c1680ed2ad151bc4d4c1967acf88b4d4d5f65746fbbf18b79
SHA512

35aff3ca70875311d40e95990ec918aac4a19337a8a8dec9a1c9078e103eedd3f88c4b119c60992a46224a668022fde871582df226ba011ff62997dd6ea54e4c
SSDEEP

1536:YplA7s9BynQZ9OtMcu231Sh//HD5HfUBuf:YrA7sy+9AMd2369Rf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
156847a4e6787c40459126623139c849

Files

156847a4e6787c40459126623139c849
.dll windows:5 windows x86 arch:x86

16d0be2b7172d0f3b038aa3eb5821f6a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeSetImportanceDpc
strncpy
RtlCopyString
MmAllocateNonCachedMemory
RtlIntegerToUnicodeString
RtlEqualUnicodeString
KePulseEvent
RtlInitString
MmForceSectionClosed
IoGetDeviceObjectPointer
ZwQueryVolumeInformationFile
ExRaiseAccessViolation
CcDeferWrite
FsRtlAllocateFileLock
KeCancelTimer
RtlPrefixUnicodeString
RtlCompareString
RtlEqualString
ZwCreateKey
KeWaitForSingleObject
RtlInitUnicodeString
ZwDeviceIoControlFile
FsRtlLookupLastLargeMcbEntry
KeQueryInterruptTime
KeInitializeTimerEx
IoAllocateController
PsTerminateSystemThread

Exports

Exports

mtikrpDVD_IB_K_TUnfimONIUOB__QJQHX_H_O
KZRQUpsuqrw_n_tKP___Foxsaf__hla_
oypevT_UGV_e_cgvjV_dRXHJI_ED__V_Pimf_jmWR_VCJ
v__cuqHHX___B_RurHTBH_Xg__eLK_F_IrvmATRT_dwmtcc__iRGcta
rf_uj_yyes_acamB_Ufiob
DOH_VQWOEZQYJZ_yqxu__KWFO_G_Qqta_dWGnxh_u_e_otfiowmEPEd
N_IBkiiFdpd_rcC

Sections

.text
Size: 24KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16d0be2b7172d0f3b038aa3eb5821f6a

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 87KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 10KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 888B

.text
Size: 24KB - Virtual size: 87KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 888B