6254b46e48aa41698893cea9b8250afe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6254b46e48aa41698893cea9b8250afe
Size

72KB
MD5

6254b46e48aa41698893cea9b8250afe
SHA1

fbd5d63670df17636699f14ea5adcb8f971690d1
SHA256

ae64fd1523331bc7db463acf9756800d98e97320d9b28ff35e7684af87e4b44c
SHA512

e2bf8ca47e55be45b1eef1800293ae78608c0bc20bd170829412e4e00103db3b9d2d1c1506d1e9202557d304b77611d0deb2d93a413e5327e37c2e8dc0ef3471
SSDEEP

1536:em0FtLSnoSBzx4rEI9WLSPcmQNrEd/Qie:gF0HBzRLSPsNk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6254b46e48aa41698893cea9b8250afe

Files

6254b46e48aa41698893cea9b8250afe
.dll windows:4 windows x86 arch:x86

3af9f835ed6413813906af27a4ed932b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

wcschr
SeSetSecurityDescriptorInfo
isupper
PsRevertToSelf
RtlFreeRangeList

hal

HalRequestIpi
HalClearSoftwareInterrupt
HalAllocateCrashDumpRegisters
HalSystemVectorDispatchEntry
READ_PORT_USHORT
HalSetEnvironmentVariable
ExReleaseFastMutex
HalGetBusData
KeTryToAcquireQueuedSpinLock
HalHandleNMI
READ_PORT_UCHAR
HalFreeCommonBuffer
HalDisplayString
KeAcquireSpinLock

Sections

.data
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ