7dca260330e6fbee78e279dfb1ebef51

General

Target

7dca260330e6fbee78e279dfb1ebef51
Size

73KB
MD5

7dca260330e6fbee78e279dfb1ebef51
SHA1

297e1fe7965d1889e5abe7dd963b429dc226b332
SHA256

56ce3e4d7ff887ad411596c075ea605c32c5618cb92066f1b319854f329fe721
SHA512

c04a3aa4b88de43fe4c80ffa1b2ed68ff500443a470f8f399bacef8bb11e502c425dbd993994a0acd6505322fb924bd50790e119c54138ad1930ef6cc238b7f0
SSDEEP

1536:fKJUWYY4y5yCiM6bVclVUjfQxklAyot1E:fil58ncl2rQkzot1E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dca260330e6fbee78e279dfb1ebef51

Files

7dca260330e6fbee78e279dfb1ebef51
.dll windows:5 windows x86 arch:x86

894ead0904a546f5877584bf3af307be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\ysudPrGif\CigGsiCsefoeg\spzlrllX.pdb

Imports

ntoskrnl.exe

IoGetTopLevelIrp
CcMapData
ExGetPreviousMode
IoGetDeviceProperty
PsCreateSystemThread
FsRtlNotifyUninitializeSync
RtlWriteRegistryValue
ObCreateObject
KeTickCount
KeEnterCriticalRegion
ZwReadFile
FsRtlIsFatDbcsLegal
IoBuildSynchronousFsdRequest
IoVerifyPartitionTable
ExRegisterCallback
KeInitializeSemaphore
SeLockSubjectContext
RtlAnsiStringToUnicodeString
RtlFindNextForwardRunClear
RtlCreateAcl
IoStartPacket
RtlGetVersion
KeSetBasePriorityThread
ExSetTimerResolution
ExRaiseAccessViolation
MmIsVerifierEnabled
SeCaptureSubjectContext
RtlCreateSecurityDescriptor
KeGetCurrentThread
CcFlushCache
IoBuildPartialMdl
KeInitializeQueue
ObReleaseObjectSecurity
ZwDeleteValueKey
FsRtlFastUnlockSingle
KeInitializeDpc
KeSetTargetProcessorDpc
KeLeaveCriticalRegion
MmUnmapReservedMapping
KeInitializeSpinLock
KeDelayExecutionThread
IoReleaseVpbSpinLock
IoDeleteDevice
ObReferenceObjectByHandle
ExDeleteResourceLite
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag

Exports

Exports

?PutListExW@@YGPAIEH_N<V
?CallVersionOld@@YGPA_NPAHPAD<V
?FreeKeyboardA@@YGIPAJ<V
?DeleteFolderPath@@YGPAKGM_N<V
?IsDateTimeW@@YG_NJF<V
?InsertTextExA@@YGFKE<V

Sections

.text
Size: 64KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

894ead0904a546f5877584bf3af307be

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 85KB

.text
Size: 64KB - Virtual size: 85KB