b81e47173eef7fa2d5c6ee7b833b7eea

General

Target

b81e47173eef7fa2d5c6ee7b833b7eea
Size

135KB
MD5

b81e47173eef7fa2d5c6ee7b833b7eea
SHA1

2306788d26caf47af9b591368caee0da24737600
SHA256

e6485737c9ab71ff7d1d57c482b43eb84b702085f24caab7573239a53d070934
SHA512

3ddb6c236ca17bccf470e6b6926fd535f2e50b5991067801519e8d9bf6965b9178367517115a6dad303ce321d520433b172bdf7716bea5634ff0e971d1468b83
SSDEEP

3072:c+jn+3Ygpo4VOfpfgWA7uKY6x06v/AHT/T6JciDmtUSpiJI6:c+YrrMfgWA7u76xRAHzjiDJdJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b81e47173eef7fa2d5c6ee7b833b7eea

Files

b81e47173eef7fa2d5c6ee7b833b7eea
.dll windows:5 windows x86 arch:x86

b34fad881772fb511d564376fce58c35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\FXvjlBSkp\hxuUSXBabswfwk\sutjlMJuFTKgxi.pdb

Imports

ntoskrnl.exe

RtlCheckRegistryKey
ZwFlushKey
_wcsupr
PsLookupThreadByThreadId
RtlRemoveUnicodePrefix
RtlEqualString
RtlDeleteRegistryValue
PoCallDriver
MmLockPagableSectionByHandle
KeResetEvent
ZwCreateDirectoryObject
RtlEqualUnicodeString
RtlAppendStringToString
MmQuerySystemSize
RtlInitializeGenericTable
KeReleaseSemaphore
MmAllocateContiguousMemory
RtlInitUnicodeString
FsRtlNotifyInitializeSync
RtlClearAllBits
RtlCompareString
RtlVerifyVersionInfo
RtlHashUnicodeString
RtlFindClearBits
RtlAreBitsClear
RtlInitString
RtlCopyUnicodeString

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.file
Size: 512B - Virtual size: 437B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.type
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b34fad881772fb511d564376fce58c35

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 30KB - Virtual size: 29KB

.file Size: 512B - Virtual size: 437B

.data Size: 2KB - Virtual size: 22KB

.rdata Size: 10KB - Virtual size: 9KB

.type Size: 1024B - Virtual size: 899B

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 712B

.text
Size: 30KB - Virtual size: 29KB

.file
Size: 512B - Virtual size: 437B

.data
Size: 2KB - Virtual size: 22KB

.rdata
Size: 10KB - Virtual size: 9KB

.type
Size: 1024B - Virtual size: 899B

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 712B