1a7729ba0ebae1a55ecbff5e9dfbba75 | Triage

Sharing

General

Target

1a7729ba0ebae1a55ecbff5e9dfbba75
Size

31KB
MD5

1a7729ba0ebae1a55ecbff5e9dfbba75
SHA1

24ea6a112e1a9bde5b33562f85f84bef08250ebd
SHA256

b4762136d7ecc5740ec50a4bc8e7f1d6c905a34bbf75e4071b88fe57ec474a6c
SHA512

7c5f3f796f6c05160280f352b9697d8fc33d7b86f0051861711d2d46260d4f6d00cbb0e823029c6d20ddaf5521f3a7ec1394e30617d62123e94969b551208bfd
SSDEEP

384:tylONm2UQlGUQXvdBJtI0ab7OeKHgkf6eWfY0Dk7kJVd79H5XZ8j45Su3yH:tlmbTFBJRab7OeKr1Cz98o3yH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a7729ba0ebae1a55ecbff5e9dfbba75

Files

1a7729ba0ebae1a55ecbff5e9dfbba75
.sys windows:6 windows x86 arch:x86

b51d29b3530d25827573676942998e55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

memcpy
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 145B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 256B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 128B - Virtual size: 110B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ