d765fec0b95d1ec9070ba0b4c2a0fde8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d765fec0b95d1ec9070ba0b4c2a0fde8
Size

6KB
MD5

d765fec0b95d1ec9070ba0b4c2a0fde8
SHA1

928d0f6fc0eeb3d55b79bd6c2b61d27b3bfec4a0
SHA256

fbe362caa2e68279cd6596427f972d1b2b7e3a6333869502d33f75f984457e24
SHA512

826c826572bdfc22a63c3f87ee38703187cc568ee96d430afb3b9ea779563e14825f51b41f89d9c51d6786369e2afcbaff1a8f0e324bda602ecb30c06d515e0a
SSDEEP

96:Rulacj6AhYQ3BFlFP/Jk1nJsDidukxnDhyOYL+KFaTfQy1cApxppVSz:Rq1uQDxkRuixnDE/LRFYxH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d765fec0b95d1ec9070ba0b4c2a0fde8

Files

d765fec0b95d1ec9070ba0b4c2a0fde8
.dll windows:5 windows x86 arch:x86

e610606a11a87777a4b7b6452a47757a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ADPlus2010\ADPlus5.0\Setup2.0\miniDriver\Check\MiniDriver.pdb

Imports

ntoskrnl.exe

ZwClose
PsCreateSystemThread
RtlDeleteRegistryValue
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwWriteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlRandom
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlGetVersion
PsTerminateSystemThread
ZwLoadDriver
RtlAppendUnicodeStringToString
RtlQueryRegistryValues
KeDelayExecutionThread

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 213B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 128B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 640B - Virtual size: 568B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ