02795e1b347661a40501165e1ffba9dcd5a1f640b1a94df09c185fc818480635

General

Target

02795e1b347661a40501165e1ffba9dcd5a1f640b1a94df09c185fc818480635
Size

44KB
MD5

d58ff37d531b5f1cfca3728c1068d7f4
SHA1

6a0df9fd05c064ed4a5b0db2c10c9db79a75ee26
SHA256

02795e1b347661a40501165e1ffba9dcd5a1f640b1a94df09c185fc818480635
SHA512

2c8ad1959efde3dedaf410a3cd653e676fba10051302fa3518acad8d6ba993800e8ef1a066dc0cfee596f07b0ccd167e03615ed988bd7b8647a6df71404bbbb6
SSDEEP

768:TW9rmC9XT0qa27pQuQynF1Mzejn81ng9f/sMOfoB0fM:mV9XTR7pTM6j8Y/sk0k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02795e1b347661a40501165e1ffba9dcd5a1f640b1a94df09c185fc818480635

Files

02795e1b347661a40501165e1ffba9dcd5a1f640b1a94df09c185fc818480635
.dll windows:5 windows x86 arch:x86

878dae981769a44681df7b2aa0a33110

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\NLlI\xkSvwCs\ehkjOhuk\oRgp\btmCoeh.pdb

Imports

ntoskrnl.exe

KeInitializeEvent
ZwQueryObject
KeRegisterBugCheckCallback
PoSetSystemState
RtlSubAuthoritySid
MmForceSectionClosed
IoDeviceObjectType
KeSaveFloatingPointState
PoRegisterSystemState
SeOpenObjectAuditAlarm
IoInitializeIrp
RtlRandom
PoStartNextPowerIrp
MmLockPagableSectionByHandle
IoStartNextPacket
FsRtlFreeFileLock
KeInitializeDeviceQueue
MmUnlockPagableImageSection
ObReferenceObjectByPointer
ZwQueryValueKey
KeDeregisterBugCheckCallback
RtlFindClearBitsAndSet
IoGetCurrentProcess
RtlCharToInteger
IoGetStackLimits
FsRtlCheckLockForReadAccess
ExReleaseFastMutexUnsafe
ZwOpenSymbolicLinkObject
ZwCreateFile

Exports

Exports

?shelyzwpgq@@YGPAXPA_N@Z
?EyypflzAspPfSvVluhdim@@YGXN@Z
?jIwwQgRGuKsdERgho@@YGPAMJ@Z

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

878dae981769a44681df7b2aa0a33110

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 172B

.data Size: 2KB - Virtual size: 6KB

INIT Size: 9KB - Virtual size: 9KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 10KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 172B

.data
Size: 2KB - Virtual size: 6KB

INIT
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 2KB - Virtual size: 1KB