7e3f7ec5b7083630cdcaccfcf63df290 | Triage

Sharing

General

Target

7e3f7ec5b7083630cdcaccfcf63df290
Size

6KB
MD5

7e3f7ec5b7083630cdcaccfcf63df290
SHA1

0320be3edf55e794cb7ac4a15fbf5aa959901fda
SHA256

d3a35b4ccdf28c970b877455ae7328e4862891c00de63792c10a0594aea06a65
SHA512

77e03fdd4987515efe04b85b5dc7311fcc0d2db4a7aee73d397d3603023e14a87c8ea29f0ed5e687da22c3308c2772bb4bebbb5f247fb392e16f6b3f09224625
SSDEEP

96:5hBcUEkBBQidWhFPWJM1nCxFDidSlwxO/yOYoqjKFaTzIy2rcApxppVSz:5BEgQ/AMRCxhiHOK/oquNpxH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e3f7ec5b7083630cdcaccfcf63df290

Files

7e3f7ec5b7083630cdcaccfcf63df290
.dll windows:5 windows x86 arch:x86

e610606a11a87777a4b7b6452a47757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ