ac236a5392eb29f6f5eb4edff8779896 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac236a5392eb29f6f5eb4edff8779896
Size

130KB
MD5

ac236a5392eb29f6f5eb4edff8779896
SHA1

a0f2b95ecb789e747fe2a9adc71acb0462aa7474
SHA256

4274d94975a240118713079437411fef8b668192d6eebafe25f9c20129f2c428
SHA512

828d631d7c4f248bdc67fc15e8ffc41047a065c4acaf90bddcaceae018d16012c10e1cf8d241ac2748a85fd5e6379e910fd418e9a4d3cd12d4416701cdf1000a
SSDEEP

3072:PPYmEAj27oE1AIau/417mE43AtuxR11hhEEEhKJqVvCk:PAmX2EmAIsKE4IuxRTChGwC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac236a5392eb29f6f5eb4edff8779896

Files

ac236a5392eb29f6f5eb4edff8779896
.dll windows:1 windows x86 arch:x86

e320530cc58da09dda778ce26592f10e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

DbgPrint
ExFreePoolWithTag
strncpy
ZwQuerySystemInformation
strstr
MmMapLockedPagesSpecifyCache
ObReferenceObjectByHandle
RtlFreeOemString
IoAttachDeviceByPointer
wcsncpy
RtlAddRange
ObfReferenceObject
strncmp
ZwDeleteValueKey
KeSetBasePriorityThread
KeTickCount
PsGetProcessExitTime
RtlAnsiCharToUnicodeChar
ExAllocatePoolWithTag
_aulldiv
IoCheckQuerySetVolumeInformation
KeBugCheckEx
_except_handler3
KeQueryTimeIncrement
IoGetCurrentProcess

Sections

.data
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 672B - Virtual size: 642B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 800B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE