aa2ba52c749b782ae04e7da85efd335b

General

Target

aa2ba52c749b782ae04e7da85efd335b
Size

72KB
MD5

aa2ba52c749b782ae04e7da85efd335b
SHA1

da3255a03b37d99e4aa8f82242275e537c799901
SHA256

40d81e7e9552d4381aaa0b77b2bdb2df17e606a041430ac52929c88714a41b22
SHA512

13027f5e9db0f1b5c530b42e94f89ca2ddbadd62b23f677b66cd3c322b44c615cc0557e04ea7b033c1257bdee0090c3af440e2c7b3d2601c4fef4cb78d0ba968
SSDEEP

1536:xKJUIYY4y5yCiM6bVclVUjfQxklqxJXO3O:x8l58ncl2rQksx0e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa2ba52c749b782ae04e7da85efd335b

Files

aa2ba52c749b782ae04e7da85efd335b
.dll windows:5 windows x86 arch:x86

894ead0904a546f5877584bf3af307be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

S:\ysudPrGif\CigGsiCsefoeg\spzlrllX.pdb

Imports

ntoskrnl.exe

IoGetTopLevelIrp
CcMapData
ExGetPreviousMode
IoGetDeviceProperty
PsCreateSystemThread
FsRtlNotifyUninitializeSync
RtlWriteRegistryValue
ObCreateObject
KeTickCount
KeEnterCriticalRegion
ZwReadFile
FsRtlIsFatDbcsLegal
IoBuildSynchronousFsdRequest
IoVerifyPartitionTable
ExRegisterCallback
KeInitializeSemaphore
SeLockSubjectContext
RtlAnsiStringToUnicodeString
RtlFindNextForwardRunClear
RtlCreateAcl
IoStartPacket
RtlGetVersion
KeSetBasePriorityThread
ExSetTimerResolution
ExRaiseAccessViolation
MmIsVerifierEnabled
SeCaptureSubjectContext
RtlCreateSecurityDescriptor
KeGetCurrentThread
CcFlushCache
IoBuildPartialMdl
KeInitializeQueue
ObReleaseObjectSecurity
ZwDeleteValueKey
FsRtlFastUnlockSingle
KeInitializeDpc
KeSetTargetProcessorDpc
KeLeaveCriticalRegion
MmUnmapReservedMapping
KeInitializeSpinLock
KeDelayExecutionThread
IoReleaseVpbSpinLock
IoDeleteDevice
ObReferenceObjectByHandle
ExDeleteResourceLite
MmMapLockedPagesSpecifyCache
ExAllocatePoolWithTag

Exports

Exports

?PutListExW@@YGPAIEH_N<V
?CallVersionOld@@YGPA_NPAHPAD<V
?FreeKeyboardA@@YGIPAJ<V
?DeleteFolderPath@@YGPAKGM_N<V
?IsDateTimeW@@YG_NJF<V
?InsertTextExA@@YGFKE<V

Sections

.text
Size: 64KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

894ead0904a546f5877584bf3af307be

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 85KB

.text
Size: 64KB - Virtual size: 85KB