5361cb9d0000e065b8fa9b09ae1058c9 | Triage

Sharing

General

Target

5361cb9d0000e065b8fa9b09ae1058c9
Size

628KB
MD5

5361cb9d0000e065b8fa9b09ae1058c9
SHA1

f7b1760c5e29041a01cabcc39d1e21f55c422965
SHA256

898033daa28ba23de8b9ef132ba40ff7f530bbe6e18836b5f61f80ed364245ca
SHA512

5d8bdaedc58194cfde47980056800e3cd91ed9d97b6b47ac6631391ce5e7101119f7905131ea7dc681f041ef662f620aacdffcb601ccf0ab42304859e45ea0c4
SSDEEP

12288:iBVMfmuPgl0iO/0do/Pb2HvYHNj9DYdDZxDCAGKVMVjgW2r0XL0yAMDQJmCB:izM+uYty/uvYtBDYpZxmAGKVMVjgv3yc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5361cb9d0000e065b8fa9b09ae1058c9

Files

5361cb9d0000e065b8fa9b09ae1058c9
.exe windows:6 windows

6da3ce00d9d964628564b3eb03a6a7b8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoGetCurrentProcess
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation

ndis.sys

NdisRetreatNetBufferDataStart

fwpkclnt.sys

FwpsAcquireClassifyHandle0

hal

KeAcquireInStackQueuedSpinLock
HalMakeBeep

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bea0
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bea1
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ