643e042817eac2b8b18c6f00b497196b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

643e042817eac2b8b18c6f00b497196b
Size

70KB
MD5

643e042817eac2b8b18c6f00b497196b
SHA1

01588b4498f24b6fbefed902b59853eeb08b56ec
SHA256

41ba38f46dde237503b30481b315344cb19b2cd63fcb58a0a6594b8510928444
SHA512

32828b478aa324aecf813b13f10678415c3b69af6687928a75bcb1f2acfe4e73226c1ada93d68cdf7a9e4645280b4b9dbf980bd7b0b3b32946b1e6ce7ff1d644
SSDEEP

1536:AfSYR/NjqVb5Ft4PRLpA7FSymltPZ+JGtxCOXvXKJ5y:A3tNjqVNL4PM71ct2GTU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
643e042817eac2b8b18c6f00b497196b

Files

643e042817eac2b8b18c6f00b497196b
.dll windows:4 windows x86 arch:x86

ba4ec395e5349972c5f6fe2bb7a0a314

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

vsprintf
RtlDeleteElementGenericTable
ZwQueryValueKey
SePublicDefaultDacl
ZwSetEaFile
RtlDeleteRange
wcscmp
FsRtlGetNextMcbEntry
IoWriteOperationCount
MmUnmapViewInSessionSpace
IoWMIWriteEvent
RtlLargeIntegerArithmeticShift

hal

HalAllProcessorsStarted
IoWritePartitionTable
KeTryToAcquireQueuedSpinLockRaiseToSynch
READ_PORT_UCHAR
HalFreeCommonBuffer
HalReadDmaCounter
HalAcquireDisplayOwnership
ExReleaseFastMutex

Sections

.data
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ