4cf442bd33ad3e2961dafa9ff646ed23 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4cf442bd33ad3e2961dafa9ff646ed23
Size

5KB
MD5

4cf442bd33ad3e2961dafa9ff646ed23
SHA1

06173f0503e884baa90ad74378bf2268f4cf72cd
SHA256

cd4ddbec022f7d2b46ee12297385bcecec3f467b45e23d867887ba8f27046c91
SHA512

dca9480bf5e890cb4324e0381b86f0d9d27d6e17c415151f0e24490b426f194d43e37aa090dfebfc54ef469ceeb9913886f0ee5573ba0352956d31298057e5f9
SSDEEP

96:tmjaOzbSrtCOnb+lvGUKmpot0n/1AdDAlo:tSzbb6b+VHKmpdnkD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cf442bd33ad3e2961dafa9ff646ed23

Files

4cf442bd33ad3e2961dafa9ff646ed23
.dll windows:5 windows x86 arch:x86

3310eb3528ee14b8fb7efcec7c2edce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmIsAddressValid
ZwOpenProcess
KeServiceDescriptorTable
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ