0280eab3860f2f44d959b7840534165eee48ba41fdf89204f80c1af0ca3b1e5d

Sharing

Copy URL Twitter E-mail

General

Target

0280eab3860f2f44d959b7840534165eee48ba41fdf89204f80c1af0ca3b1e5d
Size

135KB
MD5

5d538969ee478c127fe4175776da18dd
SHA1

5239c6f04f06a76e08e82a04e575e8dc5c76fbca
SHA256

0280eab3860f2f44d959b7840534165eee48ba41fdf89204f80c1af0ca3b1e5d
SHA512

890ef3ee6ca6006782df91636b68df8cdbbe90c7d84432cdc1991daf452ca0117dde88495a11aceda5f59176ab828dddbe00f82660166b89d53b0cb7147d2795
SSDEEP

3072:4ul9A64KE9GDj1MC7tN3s7M49f0FvlyHvpkXGSCk+RgNJJI:x9A6n1Dj1VtBs7MUfAyHBFSb+RwJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0280eab3860f2f44d959b7840534165eee48ba41fdf89204f80c1af0ca3b1e5d

Files

0280eab3860f2f44d959b7840534165eee48ba41fdf89204f80c1af0ca3b1e5d
.dll windows:5 windows x86 arch:x86

456a3650a57f6a6d45bd57a969bbe3fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Installation\Setup\Directory\Setup.exe

Imports

hal

KeQueryPerformanceCounter

ntoskrnl.exe

ZwUnloadDriver
IoInvalidateDeviceState
IoReleaseRemoveLockAndWaitEx
CcCanIWrite
MmBuildMdlForNonPagedPool
KeReadStateSemaphore
SeSetSecurityDescriptorInfo
RtlTimeToSecondsSince1970
ZwDeleteValueKey
KeBugCheck
IoMakeAssociatedIrp
SeValidSecurityDescriptor
KeQueryActiveProcessors
HalExamineMBR
IoCsqRemoveIrp
IoCreateDisk
PoRegisterSystemState
PsTerminateSystemThread
ObfReferenceObject
FsRtlFreeFileLock
IoGetStackLimits
RtlUnicodeStringToInteger
KeSetTimerEx
IoRegisterDeviceInterface
IoQueryFileInformation
SeQueryAuthenticationIdToken
MmHighestUserAddress
KdDisableDebugger
IoSetShareAccess
IoGetAttachedDeviceReference
IoFreeController
KeAttachProcess
FsRtlCheckOplock
ObfDereferenceObject
ExUuidCreate
IoGetDeviceObjectPointer

Exports

Exports

?FolderPathExpressionSizeValueOld@@ADKNFPAI<V
?AddArgumentAnchorScreenOptionEx@@ADPAH_NGPAFF<V
?SetFullNameFullNameProviderW@@ADMIPAK_N<V
?CallDirectoryStateTextMediaTypeNew@@ADPAMPAHPAHPAHPAE<V
?PutDeviceProfilePathEx@@ADPAIEIJ_N<V
?FindWindowDeviceConfigAppNameOld@@ADGPAD<V
?CloseExpressionValueDateProfile@@ADJPA_NPAM<V
?KillDatePenStateOld@@AD_NEPAHPA_NPAD<V
?FindStringModuleTaskMonitorA@@ADPAHD<V
?PutThreadMessageProfile@@ADMF<V
?CloseSemaphoreTimerCharEx@@ADXKIM<V
?DeleteObjectFolderProcessTimeA@@ADHI<V
?GlobalProviderKeyNameFolderW@@ADIKPAMIPAG<V
?CancelFilePathRectWindowScreenExW@@ADPAXD<V
?HideFilePathEventThread@@ADIEEM<V
?FormatFolderPathHeaderRect@@ADJKDPAGPA_N<V

Sections

.text
Size: 29KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.txtdat
Size: 512B - Virtual size: 508B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

456a3650a57f6a6d45bd57a969bbe3fd

Headers

File Characteristics

PDB Paths

Imports

hal

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 38KB

.txtdat Size: 512B - Virtual size: 508B

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 1024B - Virtual size: 820B

.text
Size: 29KB - Virtual size: 38KB

.txtdat
Size: 512B - Virtual size: 508B

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 1024B - Virtual size: 820B