088da031521dcf97c60d9eff1cbb91a7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

088da031521dcf97c60d9eff1cbb91a7
Size

56KB
MD5

088da031521dcf97c60d9eff1cbb91a7
SHA1

8406a98dec98646c766068173750a7298eeeb61f
SHA256

281f2e2b9c4eaad9b0cbc17ed69d4cb1cb64d528e81200e089dde23b0fc57d8c
SHA512

3f98d9f828058a10ae3506eabea801515e6b714e09a5cb96789e919be0370f19e1147e0939a67f37b904cf05913088bb84142f4302591900730ddcbe4a2342b9
SSDEEP

768:uKqAYARdh2RqEr1rRfIC74cdSKoyeAdSIihmDpQ/krFefD1/clPCfU+qMt:wALHh5Er1FftUcAJAVWu87UPCfUP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
088da031521dcf97c60d9eff1cbb91a7

Files

088da031521dcf97c60d9eff1cbb91a7
.dll windows:5 windows x86 arch:x86

5405936853920ebd5ca26ff57fa17b11

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

FsRtlCheckLockForWriteAccess
strncpy
CcRemapBcb
RtlInitUnicodeString
RtlCopyLuid
ExGetSharedWaiterCount
RtlCompareString
IoIsSystemThread
RtlEqualString
RtlInitString
ExGetPreviousMode
RtlIntegerToUnicodeString
RtlCharToInteger
IoInitializeIrp
RtlInitializeSid
KeInitializeTimerEx
KeInitializeDpc
RtlEqualUnicodeString
SeSinglePrivilegeCheck
KeInsertByKeyDeviceQueue
KeCancelTimer
FsRtlIsDbcsInExpression
KeRegisterBugCheckCallback
ExFreePoolWithTag
ExReinitializeResourceLite
CcFastMdlReadWait
RtlLengthSecurityDescriptor

Sections

.text
Size: 24KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ