4e8fbb9922e68f7a876d729d0d89090c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4e8fbb9922e68f7a876d729d0d89090c
Size

124KB
MD5

4e8fbb9922e68f7a876d729d0d89090c
SHA1

c6e76cfddc6edfb3827b89979fda1c4387f5aa32
SHA256

2146ffda07a4e037863ecf84e56516648b9c8dac48e7bb25714533329383ad81
SHA512

1d9af92e89f63e69b9ca61477e29fa7b3b7a65b459743fe1252a31c6a4919acdbc7cddbb07eefce7a424e3e1ee8992541c4a6f6f358900fa12222a5a60e33c7e
SSDEEP

3072:DkqXSB5DPJLcALbs4vfMpG7l4tSVXjWE5Y0F:DkcSBxPJLcA8uGG7l4CT/LF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e8fbb9922e68f7a876d729d0d89090c

Files

4e8fbb9922e68f7a876d729d0d89090c
.dll windows:1 windows x86 arch:x86

26ff019ae5ba9be3e310ba0354a613f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePoolWithTag
RtlSplay
_except_handler3
KeQueryTimeIncrement
KeBugCheckEx
strncmp
KeTickCount
DbgPrint
strstr
IoRegisterShutdownNotification
RtlUlonglongByteSwap
ExInitializePagedLookasideList
RtlValidRelativeSecurityDescriptor
RtlAnsiCharToUnicodeChar
PsRevertToSelf
ZwQuerySystemInformation
strncpy

Sections

.data
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 640B - Virtual size: 636B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 608B - Virtual size: 582B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE