1d9c667c387318bbaa2fbef04968cc83 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1d9c667c387318bbaa2fbef04968cc83
Size

6KB
MD5

1d9c667c387318bbaa2fbef04968cc83
SHA1

93c9abcc765b23eb7a3084add06d7673532cd43b
SHA256

39ee8b768c7001fa58a0fddadf6f2f7d86febb350312f680cb6b2b42d2fcd714
SHA512

597b517bbdb840ea7447d141ca4463c96b282a5d7c3f5fa6712c5a54e0006da9afbf940427bd38876560ff75db878fdee2aa9ee148936244eebd2706da1ec98e
SSDEEP

96:oMapzKeuD3GOn4XsCQEFprii1pGKph1u2O/:jjes0o01M/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d9c667c387318bbaa2fbef04968cc83

Files

1d9c667c387318bbaa2fbef04968cc83
.dll windows:4 windows x86 arch:x86

e1cbdef7bdecdb880ffc17d4241ca73a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

NtCreateFile
RtlInitUnicodeString
ZwQueryInformationFile
memcpy
memset
ExAllocatePool
ZwClose
ZwCreateSection
_stricmp
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwUnmapViewOfSection
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strcat
strrchr
strcpy
ZwQuerySystemInformation
NtBuildNumber

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ