21ddb4e09e32c81b34ec119cc1713160 | Triage

Sharing

General

Target

21ddb4e09e32c81b34ec119cc1713160
Size

73KB
MD5

21ddb4e09e32c81b34ec119cc1713160
SHA1

cf4d79d142118db282e915bba07dc44b7063a698
SHA256

3a224f2c3239347ae764c18feb578b47e2d2a42840d095b95ef931a8960a1f4e
SHA512

e8cad04d00d2c83516319baefdb7f28253e00b98e06c1fa9661c83ca4179a56545580d937f3cd2718d7dd7fec2d8ce9512b06eed69a1219fefcf1de07ce8e042
SSDEEP

1536:UGnD7SErvH635tE01Ri5HqcBMpBP0JEWcWMXu6WC15xqnan5:bDva/EGRi5w0JEWdMP7jCs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21ddb4e09e32c81b34ec119cc1713160

Files

21ddb4e09e32c81b34ec119cc1713160
.dll windows:4 windows x86 arch:x86

cbefd9533f8cd83666b8c5c28ab4dff4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

MmUserProbeAddress
FsRtlBalanceReads
ZwFlushVirtualMemory
KeQuerySystemTime
RtlxUnicodeStringToAnsiSize
RtlInitAnsiString
MmAdjustWorkingSetSize
MmLockPagableSectionByHandle
Exfi386InterlockedIncrementLong
RtlCreateUnicodeString
ZwYieldExecution

hal

KeReleaseQueuedSpinLock
HalCalibratePerformanceCounter
KeAcquireQueuedSpinLock
KeAcquireSpinLock
KeAcquireSpinLockRaiseToSynch
HalInitializeProcessor
IoWritePartitionTable
HalClearSoftwareInterrupt
KeLowerIrql
IoFlushAdapterBuffers
KeAcquireQueuedSpinLockRaiseToSynch
WRITE_PORT_BUFFER_USHORT
HalStartProfileInterrupt

Sections

.data
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 797B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ