70e3336fdec1911387d636cdfe9a4725 | Triage

Sharing

General

Target

70e3336fdec1911387d636cdfe9a4725
Size

73KB
MD5

70e3336fdec1911387d636cdfe9a4725
SHA1

5c2f950d39c50a04ce89c6fd4a68209ed9de67be
SHA256

b11608aefeec0fc041543280e7e2419ba35c47203a5825d69959789cc49cdb0d
SHA512

4b777b7256fd54d4e042dfbb4a350962ab564c93df23594bcd7019932215b2354cc5f66ed5ad4266394226e5ecbde00d0e97f5d8d3b86b4acf80bd7129130a62
SSDEEP

1536:de2fXQwGf6xRBJu/gwefgrU6NVN6o9qnInIEclAGW3L6:w2fADf69QYwBA6NVNiOLrL6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70e3336fdec1911387d636cdfe9a4725

Files

70e3336fdec1911387d636cdfe9a4725
.dll windows:4 windows x86 arch:x86

57469169717feea3b97a731f7bd2e860

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

NtQueryDirectoryFile
ZwQueryVolumeInformationFile
RtlCompareUnicodeString
RtlRemoveUnicodePrefix
KeDisconnectInterrupt
IoInitializeIrp
RtlAppendStringToString
RtlEqualUnicodeString
KiEnableTimerWatchdog
CcScheduleReadAhead
ZwQueryDefaultUILanguage

hal

HalReportResourceUsage
HalClearSoftwareInterrupt
WRITE_PORT_USHORT
KeGetCurrentIrql
KeQueryPerformanceCounter
HalGetBusDataByOffset
HalSetBusDataByOffset
KeTryToAcquireQueuedSpinLock
READ_PORT_BUFFER_USHORT
KeStallExecutionProcessor
HalQueryRealTimeClock
WRITE_PORT_UCHAR
IoMapTransfer
ExAcquireFastMutex

Sections

.data
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ