9a74b077d0d00499e5f78cab7b2c066c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9a74b077d0d00499e5f78cab7b2c066c
Size

42KB
MD5

9a74b077d0d00499e5f78cab7b2c066c
SHA1

9f3d1df74080454ee152d855bb0f37d818329e43
SHA256

56c1f1c983903cf1fd0d0da3f380589cd26ef66e27b1ef6f51e66c1319af7de5
SHA512

994f8566fd43921ea3655f9b14217cbfcee18bf7ccf34af4887bd8dcbcd307a43df57ab8bc4c0ad9372619109f33fc067e63bc5a666ebee79b78771965074157
SSDEEP

768:xPQV4LdE9U0HJ67n/BMeErgF8cN1zYrXJStHndIpWkICupNG3:RY4LiSTBMeigpzKXEHK4pq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a74b077d0d00499e5f78cab7b2c066c

Files

9a74b077d0d00499e5f78cab7b2c066c
.dll windows:5 windows x86 arch:x86

a23811135256458e65eae117edb13b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

J:\TIotryqv\WzsZr\syMmhqll\rfkIjZ\AjJAxcu.pdb

Imports

ntoskrnl.exe

RtlTimeToTimeFields
IoGetDeviceProperty
RtlCopySid
RtlWriteRegistryValue
KeSetImportanceDpc
CcRemapBcb
IoInvalidateDeviceState
RtlEqualString
MmSecureVirtualMemory
ObReferenceObjectByHandle
FsRtlIsDbcsInExpression
MmMapLockedPagesSpecifyCache
RtlInitString
RtlFillMemoryUlong
FsRtlIsNameInExpression
IoCreateDevice
KeInsertByKeyDeviceQueue
ZwFreeVirtualMemory
MmUnsecureVirtualMemory
ExSetTimerResolution
IoCheckShareAccess
RtlInitAnsiString
RtlFindClearBits
RtlFindClearBitsAndSet
CcFastCopyWrite
KeRemoveEntryDeviceQueue
KeSetEvent
RtlCompareString

Exports

Exports

?bPnPhxbCZyZXirokvbn@@YGIPAK@Z

Sections

.text
Size: 15KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ