ad2b10e490cd0c22c09cf062b8d9cbd0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad2b10e490cd0c22c09cf062b8d9cbd0
Size

4KB
MD5

ad2b10e490cd0c22c09cf062b8d9cbd0
SHA1

a40a7af09188091c4691f9adc1ca02702e1c19e5
SHA256

4775289f790ff93663fe9a884499835ae42daaa82c10545b418a8facc5579ce4
SHA512

b75f11ae9e2050283c03804dd50993a4bcca39fd3f7dd300e01ddbd6bed31673748466fa8d71da0e333adf8a139e85c56db0c0d248389afa0c4b76469578fbf2
SSDEEP

48:iWHbqqW5MMnCZghdW9HgYl8vJCMMUMM9GTNcI6wsMMPch40JMMp1TllMMNMq8yOo:JWrPUl6zoBtTl3scJJ1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad2b10e490cd0c22c09cf062b8d9cbd0

Files

ad2b10e490cd0c22c09cf062b8d9cbd0
.exe windows:5 windows x86 arch:x86

e4f0dc4743aec0a08615e627b06adaec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
wcscat
RtlFreeAnsiString
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 640B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ