63d85df36bf0ad3a49bf7d5a509c0ae0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63d85df36bf0ad3a49bf7d5a509c0ae0
Size

72KB
MD5

63d85df36bf0ad3a49bf7d5a509c0ae0
SHA1

4264918383c273bb9e8525b72158511b0d4bc4b0
SHA256

43e01a89ea58460d80fe0b1f850d1deb70baae5ee48bb3075a4b127489fd22d3
SHA512

e9c4fce5449a6ae8a56b17741a66449aaa5c0a88a0839a5804c61eb8be9c9c776d0b9269b68354195f74a478f6a3faee38d4a0acd32f9446341020cd789d6aee
SSDEEP

1536:NRixOHcmYK9vUAl516VtA8bK5F13li83m/NSqVf46/:NMgcCNUKT35F13lDmzf46

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63d85df36bf0ad3a49bf7d5a509c0ae0

Files

63d85df36bf0ad3a49bf7d5a509c0ae0
.dll windows:4 windows x86 arch:x86

248c5e342da87fdcee4acda59ec4d447

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IoCheckQuerySetFileInformation
FsRtlFastUnlockSingle
IoPnPDeliverServicePowerNotification
KeLoaderBlock
ZwWriteFile
PoRegisterDeviceForIdleDetection

hal

HalEnableSystemInterrupt
KeStallExecutionProcessor
KeReleaseQueuedSpinLock
HalAcquireDisplayOwnership
HalClearSoftwareInterrupt

Sections

.data
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ