3b2ca2958f05dddd789f6d94f7989ca1

General

Target

3b2ca2958f05dddd789f6d94f7989ca1
Size

8KB
MD5

3b2ca2958f05dddd789f6d94f7989ca1
SHA1

923e61be49922ca67e38e686107ce2521c80f53c
SHA256

fcde1a1b1f656cd21b26c8e579a1a1d41622c21aa92afb38a224bd58164a3406
SHA512

4a00b5a7cd01b8da1f09b181c7d48df3b3f0a312326757980acf4ad59c4f315748cb91c0cfd4ddd7d57a3fb359bf8312e236c0b5e0329ebbe93a826f21404815
SSDEEP

192:IpZg94E7Yytd6EOK3yhwR/6NQ61lfAOPB2VHPXwC6t+Q:IpW4V1a/6NQ63fBPBgbC+Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b2ca2958f05dddd789f6d94f7989ca1

Files

3b2ca2958f05dddd789f6d94f7989ca1
.exe windows:5 windows x86 arch:x86

a11620af82c1b752a745216f70650f07

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IofCompleteRequest
ExAllocatePoolWithTag
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwEnumerateKey
ZwDeviceIoControlFile
ZwQueryDirectoryFile
ZwCreateKey
ZwSetValueKey
wcscmp
_except_handler3
ExFreePool
strncat
ZwQuerySystemInformation
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
_stricmp
IoGetCurrentProcess
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwUnmapViewOfSection
strncpy
ObfDereferenceObject
KeDetachProcess
KeAttachProcess
PsLookupProcessByProcessId
strncmp
IoDeleteSymbolicLink
PsGetVersion
wcslen
RtlInitUnicodeString
IoDeleteDevice
RtlCompareMemory

hal

KfRaiseIrql
KfLowerIrql
KeGetCurrentIrql

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 576B - Virtual size: 554B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a11620af82c1b752a745216f70650f07

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 320B - Virtual size: 308B

.data Size: 192B - Virtual size: 192B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 576B - Virtual size: 554B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 320B - Virtual size: 308B

.data
Size: 192B - Virtual size: 192B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 576B - Virtual size: 554B