d97c77148e40fe1e9fb9af7cc22dbbd0N[.]exe | Triage

Sharing

General

Target

d97c77148e40fe1e9fb9af7cc22dbbd0N.exe
Size

18KB
MD5

d97c77148e40fe1e9fb9af7cc22dbbd0
SHA1

750bcd46b181fc9fcb0c2eeaac940035e13a8496
SHA256

21c1910d2126ef35c638ae8858b8726a0eafc5a0a51c15327484a83c04ff05ae
SHA512

628f47f46124110f0b23055d200ece7c91c6695cd072101786a62944229806daef264b5b1787aac96cfd7afbc531b8ab67765d69d8328910e51bf34bf22e1b24
SSDEEP

384:UsN4/6LNrqmTYvlenEvjp2FuL7O1m2efamRbzTj:HN4ipqMSgEvNBOASmZzTj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d97c77148e40fe1e9fb9af7cc22dbbd0N.exe

Files

d97c77148e40fe1e9fb9af7cc22dbbd0N.exe
.dll windows:4 windows x86 arch:x86

6ad19e9020fa6b3928562d090434410b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

PsGetCurrentProcessId
DbgPrint
KeServiceDescriptorTable
MmIsAddressValid
KeAddSystemServiceTable
_except_handler3
PsGetVersion
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IofCompleteRequest
NtOpenProcess
MmGetPhysicalAddress
MmFreeNonCachedMemory
Ke386SetIoAccessMap
Ke386IoSetAccessProcess
IoGetCurrentProcess
MmAllocateNonCachedMemory
IoDeleteSymbolicLink
ZwClose
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
PsLookupProcessByProcessId
ObReferenceObjectByHandle

hal

HalTranslateBusAddress

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ