d1c64299502ec0f1cb3885b2160ce4e5f5690641023952e0777011e619d9b3a1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d1c64299502ec0f1cb3885b2160ce4e5f5690641023952e0777011e619d9b3a1
Size

46KB
MD5

ca5d3d7dd19c0f0645495c7871a4ac07
SHA1

c90e3dbc9204af55372c066c1c7c2cd4a7858b30
SHA256

d1c64299502ec0f1cb3885b2160ce4e5f5690641023952e0777011e619d9b3a1
SHA512

1c9bfd3d6e7a53a9b7b67f5a5bcf0856538e08fa6f17dea6bcbb0ace4bac2c43ef113ccca526506d2201c20a93dc792c087c6b94c95d4eacedb37fbe23f57a39
SSDEEP

384:/CC/QWUEo9Xc9mRrJoF9EeBKLnSpTlByLOcc5KP7B0KeO2kXtQGMiZbpM:cWrSIUQ9ELLnMByLTGKDmO1tHMiVpM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1c64299502ec0f1cb3885b2160ce4e5f5690641023952e0777011e619d9b3a1

Files

d1c64299502ec0f1cb3885b2160ce4e5f5690641023952e0777011e619d9b3a1
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
zhkf
zhko

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ