3a00333e95a401290d6c4263b11e3473 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a00333e95a401290d6c4263b11e3473
Size

159KB
MD5

3a00333e95a401290d6c4263b11e3473
SHA1

55b1373909e099d30e078131ac88b0c6af16845b
SHA256

1dd4187d7667f64f7c92617514f2a9a31b4c250cb8901ac706d0e35a21433526
SHA512

9baef8508451c757feb274d8550e6432d53727ae3054e35d7b3b1ca6ee213941511f27860bc6e59cc32ee3a77d07b3d0a32e9fa39f6e7ec6e51330de3935edb5
SSDEEP

3072:FBszvOmyNJQlhJn0R+G1ZY0Dv0DzxOpyveIn0C2cJaJFs0r9gkJKqDm+TAnBRjvt:FBszvpy3OhJn0MzwA0C2ckJ4f+iBRjv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a00333e95a401290d6c4263b11e3473

Files

3a00333e95a401290d6c4263b11e3473
.dll windows:5 windows x86 arch:x86

4b56a84d1ee6d025c83549dbdbfef5f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoSetDeviceInterfaceState
RtlFindClearBits
ZwEnumerateKey
IoIsWdmVersionAvailable
strncpy
KeLeaveCriticalRegion
RtlPrefixUnicodeString
RtlInitString
ZwDeleteKey
SeAssignSecurity
IoDeleteSymbolicLink
RtlEqualUnicodeString
RtlCompareString
RtlInitUnicodeString
IoIsSystemThread
KeInitializeTimerEx
KeInsertQueue
RtlRemoveUnicodePrefix
RtlEqualString
KeCancelTimer
RtlIntegerToUnicodeString

Sections

.text
Size: 24KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ