ba6aa64c07373a7ac6cb30a16ac67fc5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ba6aa64c07373a7ac6cb30a16ac67fc5
Size

5KB
MD5

ba6aa64c07373a7ac6cb30a16ac67fc5
SHA1

be1546bb92463336ceea6b817c343cd7eba3e587
SHA256

e778b4f6cef715f293fe33a935ba92e6aa7ba51a0560449091b66daf2ce440d2
SHA512

3292e9155b21e547844e444e8eb554b12fdf5554edd4dc24c87f2d3af667a0cfbe39d281bf7e5d5892931533ec110ee2817a6a3bf4fea2d7da48826dd6a17f44
SSDEEP

48:ipY9NwnIsPxzXr9WzQ7pxKXpviTMkHVA49lKludG87lBS5rHLRrdr4g1:3lo9+Q7pxKXpuA49lKZ0BIrr12g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba6aa64c07373a7ac6cb30a16ac67fc5

Files

ba6aa64c07373a7ac6cb30a16ac67fc5
.dll windows:4 windows x86 arch:x86

535b93318e4cef26354b945724f0d333

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\vssvd\codebase\_projects\products\_Branches\WFX5(1.0.21.0)\_Release\df_kmd.pdb

Imports

ntoskrnl.exe

DbgPrint
IofCompleteRequest
ZwClose
MmMapLockedPages
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwOpenFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
swprintf
ZwReadFile
_allmul
ZwWriteFile
ZwQueryVolumeInformationFile

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ