297bc492157d4881959f65f64cf3ab34 | Triage

Sharing

General

Target

297bc492157d4881959f65f64cf3ab34
Size

65KB
MD5

297bc492157d4881959f65f64cf3ab34
SHA1

00233c156bf1e04165fa6f493170a4338cb1ccc8
SHA256

1d8d9521c4e5dce2a1b8d56fc3ce2c9e4f01170b18f51f241e606b99ef17f6d7
SHA512

41432acfe64a8305367753df446265c8470c2ecc117230c1376f1672ddf366e3676af60d7ad62fe3feda894e6feebc6e96b8fd8216084aa1953a32b130d1fe83
SSDEEP

1536:rdmFFLIlTOp9ZlNjBUnWCKQV0/BcYTrZ7ammE5TWX028:rdmFBCOllfluwLrhambtCZ8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
297bc492157d4881959f65f64cf3ab34

Files

297bc492157d4881959f65f64cf3ab34
.dll windows:4 windows x86 arch:x86

bde20d818ca9518e9b11623ef4e89b42

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

KeTickCount
KeInitializeTimer
KeInitializeSpinLock
KeInitializeEvent
PsGetCurrentThreadId
PsGetCurrentProcessId
MmQuerySystemSize
PsGetVersion
KeQueryActiveProcessors
KeInitializeMutex
IoGetCurrentProcess
memcpy
memset
KeGetCurrentThread

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ