2542539f015671f9c23c7fd00ed062b5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2542539f015671f9c23c7fd00ed062b5
Size

73KB
MD5

2542539f015671f9c23c7fd00ed062b5
SHA1

028bab7953758a5bc40f7ffc5a9903c63417c069
SHA256

b9ceeb43676a4711876c12ff7164a36af78fad6c0057ce05de49144f1e6fc541
SHA512

e83690c0e876760479fed7b214cfea4a57c526650db627029882d2e3c308f950c16dcae92fd1132e7244f932a94a510605162d061c58385b3695da6d3550fcb8
SSDEEP

768:uDqAYARdh2RqEr1rRfIC74cdSKoyeAdSIihmDpQ/krFefD1/cllRo4wkfgjvQ7Hm:zALHh5Er1FftUcAJAVWu87UHP47vN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2542539f015671f9c23c7fd00ed062b5

Files

2542539f015671f9c23c7fd00ed062b5
.dll windows:5 windows x86 arch:x86

5405936853920ebd5ca26ff57fa17b11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

FsRtlCheckLockForWriteAccess
strncpy
CcRemapBcb
RtlInitUnicodeString
RtlCopyLuid
ExGetSharedWaiterCount
RtlCompareString
IoIsSystemThread
RtlEqualString
RtlInitString
ExGetPreviousMode
RtlIntegerToUnicodeString
RtlCharToInteger
IoInitializeIrp
RtlInitializeSid
KeInitializeTimerEx
KeInitializeDpc
RtlEqualUnicodeString
SeSinglePrivilegeCheck
KeInsertByKeyDeviceQueue
KeCancelTimer
FsRtlIsDbcsInExpression
KeRegisterBugCheckCallback
ExFreePoolWithTag
ExReinitializeResourceLite
CcFastMdlReadWait
RtlLengthSecurityDescriptor

Sections

.text
Size: 24KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ