689e66ee01bccf8312b07b167dfc631c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

689e66ee01bccf8312b07b167dfc631c
Size

48KB
MD5

689e66ee01bccf8312b07b167dfc631c
SHA1

b816ca2cec11908499a2258e2f17c6f6e514cb58
SHA256

0e19435f2d465ba5ff44248943b8dc6392b62e93920e25bf168ac27ec30b1509
SHA512

403130de860b61a9075e0d732e8daa1ea1761cadd1f7f459534b63013c8f937ad732819856259ec0a0978812243fec4d672d6fe4081a2f9a392ece9b54b091c0
SSDEEP

768:S2o9gHwDAz5NrmdRaTxiexgR6UFwN42YmumXBVi:SFdhbUBk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
689e66ee01bccf8312b07b167dfc631c

Files

689e66ee01bccf8312b07b167dfc631c
.dll windows:5 windows x86 arch:x86

724deb44e6bd9eb17e84890cf2bb0492

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwAllocateVirtualMemory
MmGetSystemRoutineAddress
RtlInitUnicodeString
MmIsAddressValid
ZwOpenProcess
KeServiceDescriptorTable
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 178B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ