3d6a3c23eafb3de5e47bb8e2d9be0715 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3d6a3c23eafb3de5e47bb8e2d9be0715
Size

5KB
MD5

3d6a3c23eafb3de5e47bb8e2d9be0715
SHA1

ec9b440274fa6c0f9c664999aa49070ef1559c41
SHA256

f2a1bf24d4ff755fbcd76b70854862205e244a482801870511c4488a9462ba38
SHA512

0b710cba3ef0132561b730ed9c63d3046b2857476f41e157fee0e514b93f8b8da8f03aea06043ad9c7ad0e3c4db9fb095a28a3436d014d2a04fd975bcc71801c
SSDEEP

96:30e1DvzOzbSRUFW0j9uh31L5yjDAXFEX:3Dmzb7DQh31dED6F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d6a3c23eafb3de5e47bb8e2d9be0715

Files

3d6a3c23eafb3de5e47bb8e2d9be0715
.dll windows:5 windows x86 arch:x86

3310eb3528ee14b8fb7efcec7c2edce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmIsAddressValid
ZwOpenProcess
KeServiceDescriptorTable
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ