2bec9209a8ff51e55df4e4bd3570b83f

General

Target

2bec9209a8ff51e55df4e4bd3570b83f
Size

25KB
MD5

2bec9209a8ff51e55df4e4bd3570b83f
SHA1

4ab34073d25fa2dc539fecf4244debbc7c5fd816
SHA256

77f69180fb6e9fae5fe3ba4a8a926232c19db5d136169def429dea154d601765
SHA512

00a485182daea052853fc753b2162cb424640c070386bb9adf998c472e43f6710321e94edf600ab5ae352f91cd6bd1a9c51f0fac954311042fcc43fcf0a6005c
SSDEEP

384:siICswaQxK4Bw6y0rLduvOiD9r643voSFCHF+IoPsl6whExWGw:Lswakw6y0rZuGiD9rP3vpKF+lZxb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bec9209a8ff51e55df4e4bd3570b83f

Files

2bec9209a8ff51e55df4e4bd3570b83f
.dll windows:5 windows x86 arch:x86

281e073dff4d7f252b5650f21be51315

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ObfDereferenceObject
ExAllocatePool
ExFreePoolWithTag
ZwClose
ZwSetSystemInformation
swprintf
RtlInitUnicodeString
IoCreateDriver
ObMakeTemporaryObject
ExUuidCreate
RtlStringFromGUID
sprintf
RtlFreeUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwCreateFile
ZwQueryInformationFile
KeQuerySystemTime
RtlTimeToTimeFields
ZwDeleteFile
ZwOpenFile
ZwReadFile
RtlIpv4StringToAddressExA
KeInsertQueue
KeRemoveQueue
KeRundownQueue
IoFreeIrp
KeInitializeQueue
ObfReferenceObject
PsCreateSystemThread
ObReferenceObjectByHandle
IoBuildDeviceIoControlRequest
IofCallDriver
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
PoStartNextPowerIrp
IofCompleteRequest
PoCallDriver
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
ObReferenceObjectByName
IoDriverObjectType
IoEnumerateDeviceObjectList
IoCreateDevice
RtlInitializeGenericTableAvl
ZwCreateSection
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
ZwFlushVirtualMemory
ZwOpenKey
ZwEnumerateKey
ZwDeleteKey
ZwQueryKey
IoQueueWorkItem
ZwLoadDriver
ZwQueryDirectoryFile
IoGetRelatedDeviceObject
IoDeleteDevice
RtlPrefixUnicodeString
wcsrchr
IoAllocateWorkItem
KeInitializeTimer
KeInitializeDpc
KeSetTimerEx
_allmul
_allshr
_aullrem
memset
memcpy

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 425B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

281e073dff4d7f252b5650f21be51315

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 425B

.reloc Size: 1024B - Virtual size: 872B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 425B

.reloc
Size: 1024B - Virtual size: 872B