f865196507c775153e3f048f0660cb1b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f865196507c775153e3f048f0660cb1b
Size

134KB
MD5

f865196507c775153e3f048f0660cb1b
SHA1

0e86e29294ce6e03a2511415dc0f6058aa93d731
SHA256

ed657add962ef5c25f6481a18b06dae30965ddcd09405a20a2be2a4876874792
SHA512

3c9ad9effa47cb8bf6e667189d6988b97a466b4c13b504eb45f501a5e4ff89c67aaabf448851fb7da1c11430af8b395e6fcc0a7bc54bb71c767db5bd3ed9f3f7
SSDEEP

3072:aE5mt0i6p4OVTR4eLn6UTj77fcp6ULbxdnGzti5Qv2BT6F8Rc1EtL:a3t09XPesj7T0LbxdGztijT6FL1Ep

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f865196507c775153e3f048f0660cb1b

Files

f865196507c775153e3f048f0660cb1b
.dll windows:1 windows x86 arch:x86

4a8f74da9cd0b77f7f622438c43d7e15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

_except_handler3
MmMapLockedPagesSpecifyCache
ObReferenceObjectByHandle
RtlUnicodeStringToAnsiSize
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
NlsOemCodePage
ZwDeviceIoControlFile
PsGetProcessJob
IoGetCurrentProcess
ZwRestoreKey
strstr
strncmp
strncpy
DbgPrint
PoRegisterSystemState
wcsncpy
IoGetBootDiskInformation
ZwQuerySystemInformation
KeBugCheckEx
ExFreePoolWithTag
KeQueryTimeIncrement
KeTickCount
RtlInsertElementGenericTable
ObfReferenceObject

Sections

.data
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 640B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 782B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE