57cd01af58b59f42cbd5f1ca19c33d98 | Triage

Sharing

General

Target

57cd01af58b59f42cbd5f1ca19c33d98
Size

6KB
MD5

57cd01af58b59f42cbd5f1ca19c33d98
SHA1

2b0c7964d2c9b4b061c4a303719874a31077480a
SHA256

a52c6f1af498995cfcf8c300e69b4786c03b461cbbde889b241122ff936c110b
SHA512

b668ec13546fe799c71961e5fb28d5ae0543c03b5327f85042f020bb1f2cf3a2c6048e7e8c152fee34a94efbd113f1452e54f31a667a50bfc18c032650e58848
SSDEEP

96:RYycg4d3MQscC9FPP+Je1nhDidglxoyOYGrvKFaTR7yLdcApxppVSz:R14dcQqQeRli8x5/GriQMxH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57cd01af58b59f42cbd5f1ca19c33d98

Files

57cd01af58b59f42cbd5f1ca19c33d98
.dll windows:5 windows x86 arch:x86

e610606a11a87777a4b7b6452a47757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ