54db893a58fa15083abe7c2c17563c3b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

54db893a58fa15083abe7c2c17563c3b
Size

159KB
MD5

54db893a58fa15083abe7c2c17563c3b
SHA1

0127f56b1dbbb5d6f8e222f4aaf4e7fac8f4c0f4
SHA256

bff91ef0e0b8afa89ea8b7bcb91aba6c76b2e4e8b9558d333f2901d9c140d57f
SHA512

3017b87dd50aebcd5fbaa3102e7a1088d4b7b377193bcb898b2763777adc70af559c7fc2518fac45394b95344713f7441261591a8088ee0bc1ff9f04a2e6d47c
SSDEEP

3072:9p2cvXmflhJn0rHXBSZY0Dv0DzxOpyveIn0C2cJaJFs0r9gkJKqDm+TAnBRjvt:9YcvKhJn0bdzwA0C2ckJ4f+iBRjv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54db893a58fa15083abe7c2c17563c3b

Files

54db893a58fa15083abe7c2c17563c3b
.dll windows:5 windows x86 arch:x86

533a934e8fc1ef6118683ae3491dd71a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoMakeAssociatedIrp
IoFreeMdl
KeRemoveEntryDeviceQueue
ObGetObjectSecurity
RtlInitString
KeInitializeSpinLock
KdDisableDebugger
RtlInitUnicodeString
CcRemapBcb
KeCancelTimer
KeQueryInterruptTime
RtlEqualString
IoAllocateController
RtlWriteRegistryValue
KeInitializeTimerEx
strncpy
RtlEqualUnicodeString
ExSetResourceOwnerPointer
RtlCompareString
RtlUnicodeToOemN
RtlValidSid
KeInitializeApc
IoCreateSymbolicLink
ExAllocatePoolWithTag
RtlIntegerToUnicodeString

Sections

.text
Size: 25KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ