a0d0be1dc696c99a75a5b9fac30e559e | Triage

Sharing

General

Target

a0d0be1dc696c99a75a5b9fac30e559e
Size

54KB
MD5

a0d0be1dc696c99a75a5b9fac30e559e
SHA1

00c258a4e6c478d8bbf3e9d3a0822594a321cb13
SHA256

419bdc749e341900c08faaf82c0f211f2bdf68e63851a89aab20ef81c3f049da
SHA512

80e296c951f171ec4900f3bcecb08c71079ef3be50838d1d6416e519c8d59841273fc6c5ab8aa130c02f8424bb89a1c19b6e9180925e6784fa720535d2065f5f
SSDEEP

1536:Y556DtfBDNfs0giNuy5zJBKJPQY5j2UGtKbundZ:z32Jy5dBOoY0Re6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0d0be1dc696c99a75a5b9fac30e559e

Files

a0d0be1dc696c99a75a5b9fac30e559e
.dll windows:4 windows x86 arch:x86

4fa17fc110602e09aa7f1f3e6407fb21

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

ZwQuerySystemInformation
IoFreeIrp
IoCreateDevice

hal

KeAcquireSpinLock
HalMakeBeep
HalProcessorIdle
KfLowerIrql

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE