KrnlAPI[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

KrnlAPI.dll
Size

17KB
MD5

cce78a7ffc7cc0e965da8e08f18a9c6b
SHA1

e4452dc924fbefb16d24501a77b5ca79b9e7a40a
SHA256

e5297b36969146d8130db767598e01377a1aacc82d1d29905ed7be5778329f2c
SHA512

7d380e064cfcddf148e06905f4655fc3a5e0add31ae9bc5e9a48ab357e48e4d812349e2e6e1743d9e5675ef66a34f5ab758d901cf0159947a7ac2ad50874123d
SSDEEP

384:yFp/OkFC50/Etuqs5PixTljo+kQB4Lb4M6886XEEd4ONBto1xd:G8sExClQCLbfD/0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KrnlAPI.dll

Files

KrnlAPI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\jalap\source\repos\KrnlAPI\KrnlAPI\obj\Debug\KrnlAPI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ