ba2a404f77df10284337341118dd4c83

General

Target

ba2a404f77df10284337341118dd4c83
Size

135KB
MD5

ba2a404f77df10284337341118dd4c83
SHA1

c64ee6b642a5913cce2d225808961b33afa360c9
SHA256

69b7a4cc3a63364b928bb81580ecbf36278f161f666c6c7a4eae9140a4112fc4
SHA512

997b5def6501318a0b7535bfaafd98406071feda6932333f73f79494bb4acb3dfff463e8845fffd6b6f6aef83cbccc2b62affd284a8b93c6c73b928511947bcb
SSDEEP

3072:lXaocreI6fvAmigzWA7uKY6x06v/AHT/T6JciDmtUSsiJI6:4J56fvPWA7u76xRAHzjiDJuJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba2a404f77df10284337341118dd4c83

Files

ba2a404f77df10284337341118dd4c83
.dll windows:5 windows x86 arch:x86

5b47c6f3677bfd2508075d584e9c66c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Y:\lUbMcv\kxfhKI\ybrwH\hohLnCbe.pdb

Imports

ntoskrnl.exe

FsRtlGetNextFileLock
RtlEqualString
IoSetDeviceInterfaceState
RtlEqualUnicodeString
PsLookupThreadByThreadId
IoDetachDevice
IoConnectInterrupt
RtlValidSecurityDescriptor
KdDisableDebugger
KeBugCheckEx
KeCancelTimer
MmSetAddressRangeModified
RtlInitUnicodeString
RtlIntegerToUnicodeString
RtlCompareString
KeInitializeTimer
RtlCopyUnicodeString
SeQueryInformationToken
RtlInitString
strcpy
RtlUpcaseUnicodeChar

Exports

Exports

l_hrkoe_RC_JBwtnx
hOGK_OKSLCS_Tlkf_wg___I__VADAK____GQ_VR_D
IGW_GG_ch_xfsp
KX_Y_NOJgaiQOIt__upF_KK_PG_IGvO
nlyhlE_GZxwartNU_ZYhnuyxxzKQWEo_qnx_gacff_
QL_XEkqe__JZ_Jdjo_hjyRN
Y_AHVBhs_eg__LE__K
CZPZFSLEYLUAQGTBJ_mmoi__cE_Pm
J_W_XCty_
CIeuvVWWYksiXSR_YP_VJI_R_

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b47c6f3677bfd2508075d584e9c66c7

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.INIT Size: 10KB - Virtual size: 9KB

.rdata Size: 1024B - Virtual size: 732B

.data Size: 1KB - Virtual size: 65KB

DATA Size: 19KB - Virtual size: 18KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 1024B - Virtual size: 848B

.text
Size: 14KB - Virtual size: 14KB

.INIT
Size: 10KB - Virtual size: 9KB

.rdata
Size: 1024B - Virtual size: 732B

.data
Size: 1KB - Virtual size: 65KB

DATA
Size: 19KB - Virtual size: 18KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 1024B - Virtual size: 848B