0eef046e735c33860945aab74a72650f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0eef046e735c33860945aab74a72650f
Size

4KB
MD5

0eef046e735c33860945aab74a72650f
SHA1

5c540d05fee974bbbc473a8c92ff63bcdfb4f539
SHA256

bd8a8221a340fcb8b722a3ed8af08bac561c2c0d27c6abee8c7d8ca22d8f8017
SHA512

dfe874ada2f05c88e4a57f655b337e4c5b0562606751045d631f01b3c11b99a2f8ee1d1d11ab73900971de4c99ba08e51ad57b71897f4c29d5a4f83b26e93e38
SSDEEP

96:Nx1iaYo90Qy8nhW99V5KT+4MylMsLt1pD:NH+QPoMvUg1D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eef046e735c33860945aab74a72650f

Files

0eef046e735c33860945aab74a72650f
.exe windows:5 windows x86 arch:x86

8c9b88fbdbf338d360301c702d30905d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
wcscat
RtlFreeAnsiString
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ