0070576a86df3e2197a3e88b6546e37e | Triage

Sharing

General

Target

0070576a86df3e2197a3e88b6546e37e
Size

23KB
MD5

0070576a86df3e2197a3e88b6546e37e
SHA1

2ab5080754d8ada8ce1c2226b45526d5bb7f9232
SHA256

5a5266ee3fd1ab61e414cf8806eb7e820fd7c3a699676efbc3a61b4aa53460c0
SHA512

55aa6ae1c39a6954356b59102daddf9c5eaac57bec6f7126bc67727db8377454ba58a13d8c1699c1a90c49aaa98f39985c6daa6f98a526a361379084914fb00d
SSDEEP

384:xLt+5COJnYBFHGRbO4c7Zcj0Ss2R3H414RHt20JC48cCtpHiIwLwrGz:xJOPYBpGRbjtAH2RuSHt2iqcOpHinwaz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0070576a86df3e2197a3e88b6546e37e

Files

0070576a86df3e2197a3e88b6546e37e
.sys windows:5 windows x86 arch:x86

6bb11f1599a1ffbabaf4622053c97890

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
RtlInitUnicodeString
ExFreePoolWithTag
MmGetSystemRoutineAddress
ExRaiseStatus
_except_handler3

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 256B - Virtual size: 214B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ