371547469ffc2a53e6a1a4bdd188f745 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

371547469ffc2a53e6a1a4bdd188f745
Size

4KB
MD5

371547469ffc2a53e6a1a4bdd188f745
SHA1

c7439644aecd43c8c2040ec4339a09aab361ec38
SHA256

2464a9e683faca1bc9982694d8896ab6ab1da33b3587689180080641fde55370
SHA512

5ec649af3c1dcbc28cd283201dce1db547699b79b3b81f557f70602d6e0241159dff9cd699f5090e34b053402d2b2d39d3c3be0230e315d435b5b9c756a68289
SSDEEP

48:iWHbOqW0lMMnCZghdW9HgYl8vJCMMUMM9YXNcI6wsMMPch40JMMp1TllMMNMq8yr:9W2PmXl6zoBtTl3scG871

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
371547469ffc2a53e6a1a4bdd188f745

Files

371547469ffc2a53e6a1a4bdd188f745
.exe windows:5 windows x86 arch:x86

e4f0dc4743aec0a08615e627b06adaec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
wcscat
RtlFreeAnsiString
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 640B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ