3eb1eea561be7805de73899104ca4d08 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3eb1eea561be7805de73899104ca4d08
Size

133KB
MD5

3eb1eea561be7805de73899104ca4d08
SHA1

abd8af7072cc0c0bf50e97bbee86868a47fe31a7
SHA256

f00199948c649a8676a6739a2903f234e1e7cf020d53c2db88f8d4e3cc573884
SHA512

8ca63e5b2fa6d20ddd7b4191708f0943bc9a1298c3fc131120ed4a979433b3ba1306015d6746abd4c61d24082ac9bfa8deb0cc4f5bb78e3068b932e3160c5aff
SSDEEP

3072:pfoFnzrLXJ74JP/A34j3RV46KOXkILajU0J+2XhrjXTLj:pfoVzrLXh4JLjmOBajU0J+2RXT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3eb1eea561be7805de73899104ca4d08

Files

3eb1eea561be7805de73899104ca4d08
.dll windows:1 windows x86 arch:x86

8c84ebb385a5cd95727a5425b67a7d22

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

RtlAnsiCharToUnicodeChar
strstr
ObReferenceObjectByHandle
strncmp
strncpy
KeBugCheckEx
KeTickCount
DbgPrint
wcsncpy
ExFreePoolWithTag
IoGetCurrentProcess
ZwQuerySystemInformation
KeQueryTimeIncrement
ObfReferenceObject
_except_handler3
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache

Sections

.data
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 160B - Virtual size: 147B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 544B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 170B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE