c5e69b2c45ca5108500d2f47ed16f1c0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c5e69b2c45ca5108500d2f47ed16f1c0
Size

5KB
MD5

c5e69b2c45ca5108500d2f47ed16f1c0
SHA1

bcff692dcc45e01b2d2c236ee6a31ec66f5d82f0
SHA256

a851d5a1c376d256b5973fe37bd598cc208a450a5a7728f35d745fcc53057ff0
SHA512

c18c8c4c2b1d23a9a5b538e0b7181a534b28256253265204815849471854f381210c49e70f9740a4944dc191cc41fb1c8c212f115696032e78be013c4241d68c
SSDEEP

96:ZkPSJOjwUWcbFbkdOb67SCQQ0f0UFle6Jg11UxG:ZkP7pXbFbkd86AQPr6Jz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5e69b2c45ca5108500d2f47ed16f1c0

Files

c5e69b2c45ca5108500d2f47ed16f1c0
.exe windows:5 windows x86 arch:x86

3325a1a4fcabd2c615283d9ae29fc5b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 640B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 526B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 256B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ