68df7afd9d46aa32c2ba1bdabaa37479

General

Target

68df7afd9d46aa32c2ba1bdabaa37479
Size

105KB
MD5

68df7afd9d46aa32c2ba1bdabaa37479
SHA1

144118296b7f4eb1a4483a0c86001e902cac3b3e
SHA256

863dbf7d977192d96a49e65a7bd9c5988de7994f7127e9068d93954fc448d9e2
SHA512

53ca6e706e696d92543dd5a1f032bb67ddbea9ea167a62b6fbc897b7d84a17fa1a96b5403b6f198b24131a1419b60552314ef8fc8a818753caf3729607e9797e
SSDEEP

1536:95kwr0IGgD9r/w4OewgW26TPt1of/+VNrvUjwkIuMTKasrbX2yZTHL8:95k2wgDFIAw1TPu/WBMjDwEGy9HL8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68df7afd9d46aa32c2ba1bdabaa37479

Files

68df7afd9d46aa32c2ba1bdabaa37479
.dll windows:5 windows x86 arch:x86

281e073dff4d7f252b5650f21be51315

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ObfDereferenceObject
ExAllocatePool
ExFreePoolWithTag
ZwClose
ZwSetSystemInformation
swprintf
RtlInitUnicodeString
IoCreateDriver
ObMakeTemporaryObject
ExUuidCreate
RtlStringFromGUID
sprintf
RtlFreeUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwCreateFile
ZwQueryInformationFile
KeQuerySystemTime
RtlTimeToTimeFields
ZwDeleteFile
ZwOpenFile
ZwReadFile
RtlIpv4StringToAddressExA
KeInsertQueue
KeRemoveQueue
KeRundownQueue
IoFreeIrp
KeInitializeQueue
ObfReferenceObject
PsCreateSystemThread
ObReferenceObjectByHandle
IoBuildDeviceIoControlRequest
IofCallDriver
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
PoStartNextPowerIrp
IofCompleteRequest
PoCallDriver
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
ObReferenceObjectByName
IoDriverObjectType
IoEnumerateDeviceObjectList
IoCreateDevice
RtlInitializeGenericTableAvl
ZwCreateSection
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
ZwFlushVirtualMemory
ZwOpenKey
ZwEnumerateKey
ZwDeleteKey
ZwQueryKey
IoQueueWorkItem
ZwLoadDriver
ZwQueryDirectoryFile
IoGetRelatedDeviceObject
IoDeleteDevice
RtlPrefixUnicodeString
wcsrchr
IoAllocateWorkItem
KeInitializeTimer
KeInitializeDpc
KeSetTimerEx
_allmul
_allshr
_aullrem
memset
memcpy

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 425B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

281e073dff4d7f252b5650f21be51315

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 425B

.reloc Size: 1024B - Virtual size: 872B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 425B

.reloc
Size: 1024B - Virtual size: 872B