42b09f57d11c9e0b7575652229207a8b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42b09f57d11c9e0b7575652229207a8b
Size

6KB
MD5

42b09f57d11c9e0b7575652229207a8b
SHA1

fdc1d971f90020458f5a869224c24b8a23cd334e
SHA256

0f392a338060083eac29f18d7697bf68e2f04c08ff947522c4aeb903d79ee5f7
SHA512

abc70952758161b362f17ef14e402ac0f9a5bdafe047e5431012e75304833bbdd0f497a075da3757d2ffa76758e660a5dc0d5cdef72c2644ee542c6c4ad9c72c
SSDEEP

96:c84apzKeuD3GOnR2Q5uvIF9prii1pGAph1u2p:AjCWhoG1z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42b09f57d11c9e0b7575652229207a8b

Files

42b09f57d11c9e0b7575652229207a8b
.dll windows:4 windows x86 arch:x86

3f32496dbc6dd744dfaa617a9cd2ae34

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

NtCreateFile
RtlInitUnicodeString
ZwQueryInformationFile
memcpy
memset
ExAllocatePool
ZwMapViewOfSection
ZwClose
ZwCreateSection
_stricmp
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwUnmapViewOfSection
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strcat
strrchr
strcpy
ZwQuerySystemInformation
NtBuildNumber

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ