970e5124d676db8ba1dfa7824157cfec | Triage

Sharing

Copy URL Twitter E-mail

General

Target

970e5124d676db8ba1dfa7824157cfec
Size

28KB
MD5

970e5124d676db8ba1dfa7824157cfec
SHA1

1aa05816a414dfa75f6bfdb139b62ec05c72d804
SHA256

6ac37b5893fc84d8b3907d75d12cdb429edc2024a1b0a69726d9c7bc1c63d28c
SHA512

0eb58f59a66cb197155b693377b4dcd808682322eef6ab8206e8566d13be0529a05549ccf53161c26f0fecc14dd845f1f4191432bddb49fadf817796362c8475
SSDEEP

384:pO+O987vYyI4hVWCxk98nK0mHr8ijyS7VKdf/0M:Mo7YyNVWCx2wK0u8ijyzB/0M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
970e5124d676db8ba1dfa7824157cfec

Files

970e5124d676db8ba1dfa7824157cfec
.dll windows:4 windows x86 arch:x86

604af5cd27fa86801742fdf7dd75fd6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

NtClose

basesrv

BaseSetProcessCreateNotify
BaseSrvNewObDirAcls
BaseSrvNlsLogon
BaseSrvNlsUpdateRegistryCache
ServerDllInitialization

Exports

Exports

BaseSetProcessCreateNotify
BaseSrvNewObDirAcls
BaseSrvNlsLogon
BaseSrvNlsUpdateRegistryCache
ServerDllInitialization

Sections

.text
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE