7d65bb5246c5897ac86e7f1897a7c840 | Triage

Sharing

General

Target

7d65bb5246c5897ac86e7f1897a7c840
Size

65KB
MD5

7d65bb5246c5897ac86e7f1897a7c840
SHA1

15e428036ba1b9db5901ea1cfb96bd417cfee652
SHA256

22a128e6ab1db75a4f0b7e25313629a0d63e8f4ef73d5a7ca16be13c317bce8a
SHA512

8b80d450b5c219b24aaea0557f7548c2b5c8ef7f5786c535b72f6d212fa7dd013d439be9279f03080e44cb9bfb554c9dc06fd1c2c3c89bbe710505af7a1e6b93
SSDEEP

1536:UsjkyJRtFNNTZVjbi8Nx6BpH+KlUY7XIovkEmvw9u/:UYkyJRtdTZVjblcHBlUYjIo8Emvw9i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d65bb5246c5897ac86e7f1897a7c840

Files

7d65bb5246c5897ac86e7f1897a7c840
.dll windows:5 windows x86 arch:x86

f18401468686a306708f96ca1a537a7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

PsDereferencePrimaryToken
RtlInitString
RtlCompareString
IoUpdateShareAccess
KeInitializeTimerEx
ExIsProcessorFeaturePresent
KeSetKernelStackSwapEnable
PoUnregisterSystemState
SeTokenIsRestricted
RtlFreeAnsiString
RtlInitUnicodeString
RtlEqualSid
ExNotifyCallback
RtlCharToInteger
CcSetBcbOwnerPointer
FsRtlCheckLockForReadAccess
RtlEqualString
IoCreateFile
strncpy
MmUnmapIoSpace
RtlIntegerToUnicodeString
CcZeroData
RtlEqualUnicodeString
KeSetTargetProcessorDpc
IoGetDriverObjectExtension
ZwFsControlFile
KeCancelTimer
KeInitializeSemaphore

Sections

.text
Size: 24KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ