e0bab02d685e0168b28e5f74f0b94c30 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e0bab02d685e0168b28e5f74f0b94c30
Size

53KB
MD5

e0bab02d685e0168b28e5f74f0b94c30
SHA1

d0b04cfb4056b6336b5c56b27f5428d50be05e4b
SHA256

d0770b35a932e37b723abf5a8732523e06a15e6291c430e96fc8151956a89696
SHA512

e19fb7ce5db2f6ad8cc674be3055c00f05265781f68e3ed0e5e274fb506f1e8c873b4ffbbfc0cc4b8ae464b3b3f5c1bae8ecbb1b498590cef4bf921f3b518604
SSDEEP

768:3Z2mlFd01HFX6hrvgvHPr0YHSuv99fTtRmTcxzkHLZ7nZU59licE88GKB:p2m2FXWsvHPwYdv99btRD6rtnA9c9mK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0bab02d685e0168b28e5f74f0b94c30

Files

e0bab02d685e0168b28e5f74f0b94c30
.sys windows:4 windows x86 arch:x86

5e5d3f5b3d854eadc8ed895ca4faf2d2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

usbport.sys

USBPORT_RegisterUSBPortDriver
USBPORT_GetHciMn

hal

KfLowerIrql
HalProcessorIdle
KeRaiseIrql

ntoskrnl.exe

ZwCreateFile
ZwTerminateProcess
isspace

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ytr
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zasoc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ