2907e68462b4891e25eb1d04c83fd1e0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2907e68462b4891e25eb1d04c83fd1e0
Size

65KB
MD5

2907e68462b4891e25eb1d04c83fd1e0
SHA1

b58ce9188d0d64d4af48994297994abbd65e54ee
SHA256

c4b9bbc30584a5309e27aebef8ce512db4249e32361ec3ca8b55d8322cb40419
SHA512

490bc7d4cd3d6a706926c76868dcf82e7d4ff9ed1685767d41ab4941ebe384b5c045abd18f4382e00ba328075a3848b84c6f77fbfeeb9539d1c9d41a2bb3cabd
SSDEEP

1536:sdmFFLIlTOp9ZlNjBUnWCKQV0/BcYTrZ7ammE5TWX028:sdmFBCOllfluwLrhambtCZ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2907e68462b4891e25eb1d04c83fd1e0

Files

2907e68462b4891e25eb1d04c83fd1e0
.dll windows:4 windows x86 arch:x86

bde20d818ca9518e9b11623ef4e89b42

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeTickCount
KeInitializeTimer
KeInitializeSpinLock
KeInitializeEvent
PsGetCurrentThreadId
PsGetCurrentProcessId
MmQuerySystemSize
PsGetVersion
KeQueryActiveProcessors
KeInitializeMutex
IoGetCurrentProcess
memcpy
memset
KeGetCurrentThread

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ