e118f903e8cf7b29bcdbaf6da028f11b

General

Target

e118f903e8cf7b29bcdbaf6da028f11b
Size

61KB
MD5

e118f903e8cf7b29bcdbaf6da028f11b
SHA1

02552573a1140f53dd36784a25887b03fba83519
SHA256

40c65aeffe4078f6f0e86cb4b1eca6318672979a6bf50f0d1eec488dac5993a1
SHA512

53c8f7e62650a3164ab47f4025442e3fb427deab9c9a6496ab3535a9ef3ac22539e7e0c09ad4bc26230ceb71028101f57cca290c9d5c18a654f064baad05bc76
SSDEEP

1536:bVIBwY/aho5NhihJkjFEGU9qVOJ9fOajP3ztcSE58:bVIBwY/ah2NhiEJEGU7zt3E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e118f903e8cf7b29bcdbaf6da028f11b

Files

e118f903e8cf7b29bcdbaf6da028f11b
.dll windows:5 windows x86 arch:x86

443fc7e2bf1fbc2671b340c1b1dbd0f2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

K:\lMfbVswAhe\ZdHfshP\DnwUVnh\rnotxUcncbx\trgzmOmqagMu.pdb

Imports

ntoskrnl.exe

SeDeleteObjectAuditAlarm
IoAcquireCancelSpinLock
IoInvalidateDeviceRelations
RtlHashUnicodeString
IoGetBootDiskInformation
KeSetEvent
RtlEqualString
RtlTimeToSecondsSince1980
KeResetEvent
FsRtlIsHpfsDbcsLegal
RtlInitString
RtlInitUnicodeString
ZwQueryValueKey
IoSetDeviceInterfaceState
ZwQueryVolumeInformationFile
PoRequestPowerIrp
FsRtlIsTotalDeviceFailure
RtlxUnicodeStringToAnsiSize
ZwQueryKey
ExInitializeResourceLite
RtlEqualUnicodeString
RtlInitAnsiString
ExRaiseDatatypeMisalignment
IoGetDeviceToVerify

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.icode
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

443fc7e2bf1fbc2671b340c1b1dbd0f2

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 14KB - Virtual size: 13KB

.itext Size: 512B - Virtual size: 100B

.code Size: 512B - Virtual size: 320B

.icode Size: 512B - Virtual size: 320B

.data Size: 12KB - Virtual size: 48KB

.fdata Size: 512B - Virtual size: 494B

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 1024B - Virtual size: 720B

.text
Size: 14KB - Virtual size: 13KB

.itext
Size: 512B - Virtual size: 100B

.code
Size: 512B - Virtual size: 320B

.icode
Size: 512B - Virtual size: 320B

.data
Size: 12KB - Virtual size: 48KB

.fdata
Size: 512B - Virtual size: 494B

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 1024B - Virtual size: 720B