68dd499bca62e004c97ccc17f68e3d6dde2885446924dabe8cc525763caa08a3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68dd499bca62e004c97ccc17f68e3d6dde2885446924dabe8cc525763caa08a3
Size

613KB
MD5

ff448aad6c1749b382703c56919b75ed
SHA1

69d53177087b812f6e9b76a651afcf6dde76314f
SHA256

68dd499bca62e004c97ccc17f68e3d6dde2885446924dabe8cc525763caa08a3
SHA512

f86fd3367257bb659b0a5dfa0a350d35f048f369bb63675883449f5500f7fe7a6ce4ff6517c9bbd349ffb81ba519c8fd9b716a2db8d3f51056c19b0fc5d24d12
SSDEEP

12288:zliZ13Ax+CQjtSUUuQ9T9ln4BnLI1O9rVT:QZ13Ax+CQjoUUuQJ41LI1a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68dd499bca62e004c97ccc17f68e3d6dde2885446924dabe8cc525763caa08a3

Files

68dd499bca62e004c97ccc17f68e3d6dde2885446924dabe8cc525763caa08a3
.dll windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Microsoft.Management.Infrastructure.CimCmdlets.ni.pdb
Microsoft.Management.Infrastructure.CimCmdlets.pdb

Sections

.data
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ