269242cae5f221d9a9b5f752edd56c20 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

269242cae5f221d9a9b5f752edd56c20
Size

6KB
MD5

269242cae5f221d9a9b5f752edd56c20
SHA1

0005d4055301ed57009e24ecaf6abf6bfdcfa9e3
SHA256

8deac766a5419f6ab418041d26ae68527b22d57c7a7afed9a18a5902478b3ac9
SHA512

d568caff34968160f444abb6345df3022a756a0e7fe68c39ec6b375d1b75cc4110d173896677aebdefdc1cadfbf6091a88757a008919d7f3032b3aee25ce36b7
SSDEEP

96:eT/pzaeuD3GOnVkTDVIAprii1pGAp4H1u2:RjDGjo11

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
269242cae5f221d9a9b5f752edd56c20

Files

269242cae5f221d9a9b5f752edd56c20
.dll windows:4 windows x86 arch:x86

934b866c48e2d9f3100f3940d5653a0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwCreateFile
RtlInitUnicodeString
ZwQueryInformationFile
memcpy
memset
ExAllocatePool
ZwMapViewOfSection
ZwClose
ZwCreateSection
_stricmp
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwUnmapViewOfSection
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strcat
strrchr
strcpy
ZwQuerySystemInformation
NtBuildNumber

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 150B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ