c1db99c7ec43b6c112e027ddb5c8a64c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c1db99c7ec43b6c112e027ddb5c8a64c
Size

5KB
MD5

c1db99c7ec43b6c112e027ddb5c8a64c
SHA1

6e42c07afb2c5824663f420c8c7c52d5f39ae85f
SHA256

2be81763bdd3facc59f60d1d9cdc03e4c5735cebe2cb169d5fcd2466292b4dae
SHA512

99be852e3010abe728af0e77a791f16ca13a227010f4e7c66811e0ee5aa7a922111b6ff86585bd305ff1c8c72366c00445915e07be5874ff92e4d1e3fbdb1b6f
SSDEEP

48:iiiA0ra1ZWqiMcEOzbSCkFuz80kUw8Wk+/IZDVaS02L5yGvD0TgwiV8/vR:p0e1ZfvzOzbSRUFW4+gNV702L5yuDA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1db99c7ec43b6c112e027ddb5c8a64c

Files

c1db99c7ec43b6c112e027ddb5c8a64c
.dll windows:5 windows x86 arch:x86

3310eb3528ee14b8fb7efcec7c2edce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

IofCompleteRequest
ObfDereferenceObject
ZwClose
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmIsAddressValid
ZwOpenProcess
KeServiceDescriptorTable
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ