3aea9cf957f236c94b0dd97f609afeabe3956790b072c027dfb9cdf66c20725b

Sharing

Copy URL Twitter E-mail

General

Target

3aea9cf957f236c94b0dd97f609afeabe3956790b072c027dfb9cdf66c20725b
Size

47KB
MD5

49a90c9dd215e4556244f3a106199709
SHA1

45dd3235274ec229abeb0ffa818c757a49453b2a
SHA256

3aea9cf957f236c94b0dd97f609afeabe3956790b072c027dfb9cdf66c20725b
SHA512

81b260d251171951c38f858d167bfcb8da2d48a61890253e2d4e64cfd2ec753b0fe4a1fa0b43ff6b14eacc5e1fe47390c1a9fac753946891f8a59fc24ab651d2
SSDEEP

768:oqjxXW9mGAwhfbyjXXYDsnG7zXegQWPzC5V71/Xd2rJ26nqbU8VKeZ41wAIg:b4meby8DsGHXegyv7JXdQnq9iwA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3aea9cf957f236c94b0dd97f609afeabe3956790b072c027dfb9cdf66c20725b

Files

3aea9cf957f236c94b0dd97f609afeabe3956790b072c027dfb9cdf66c20725b
.dll windows:3 windows x86 arch:x86

f30a01ec4fa82070f06140fd71f57f26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

_stricmp
Kei386EoiHelper
KeSetTimeIncrement
DbgBreakPoint
KiCoprocessorError
KeSetEventBoostPriority
KeWaitForSingleObject
KiUnexpectedInterrupt
KeProfileInterrupt
KiDeliverApc
KiDispatchInterrupt
DbgPrint
RtlZeroMemory
ExAllocatePool
ExFreePool
RtlMoveMemory
ZwClose
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
RtlInitUnicodeString
KeInitializeSpinLock
RtlIntegerToUnicodeString
RtlInitializeBitMap
RtlFillMemory
KiAcquireSpinLock
KiReleaseSpinLock
IoAssignResources
ZwSetValueKey
swprintf
strncpy
KeUpdateSystemTime
MmMapLockedPages
MmGetPhysicalAddress
MmFreeContiguousMemory
MmAllocateContiguousMemory
RtlFindClearBitsAndSet
KeRemoveDeviceQueue
RtlClearBits
KeInsertDeviceQueue
RtlSetBits
ObfDereferenceObject
KeSetEvent
KeEnterKernelDebugger
MmUnlockPagableImageSection
MmLockPagableDataSection
MmMapIoSpace
RtlSetAllBits
KeInitializeDeviceQueue
ObInsertObject
ObReferenceObjectByPointer
IoAdapterObjectType
ObCreateObject
RtlFreeUnicodeString
IoReportHalResourceUsage
strstr
HalPrivateDispatchTable
HalDispatchTable
KeBugCheckEx
sprintf
KeFindConfigurationEntry
KeInitializeEvent
ExAllocatePoolWithTag

Exports

Exports

ExAcquireFastMutex
ExReleaseFastMutex
ExTryToAcquireFastMutex
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAssignSlotResources
HalBeginSystemInterrupt
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalDisableSystemInterrupt
HalDisplayString
HalEnableSystemInterrupt
HalEndSystemInterrupt
HalFlushCommonBuffer
HalFreeCommonBuffer
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetInterruptVector
HalHandleNMI
HalInitSystem
HalInitializeProcessor
HalMakeBeep
HalProcessorIdle
HalQueryDisplayParameters
HalQueryRealTimeClock
HalReadDmaCounter
HalReportResourceUsage
HalRequestIpi
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetProfileInterval
HalSetRealTimeClock
HalSetTimeIncrement
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalTranslateBusAddress
IoAssignDriveLetters
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KdPortGetByte
KdPortInitialize
KdPortPollByte
KdPortPutByte
KdPortRestore
KdPortSave
KeAcquireSpinLock
KeFlushWriteBuffer
KeGetCurrentIrql
KeLowerIrql
KeQueryPerformanceCounter
KeRaiseIrql
KeReleaseSpinLock
KeStallExecutionProcessor
KfAcquireSpinLock
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock
READ_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
WRITE_PORT_BUFFER_UCHAR
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 864B - Virtual size: 842B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 960B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f30a01ec4fa82070f06140fd71f57f26

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 1KB - Virtual size: 1KB

PAGE Size: 7KB - Virtual size: 7KB

PAGELK Size: 864B - Virtual size: 842B

.edata Size: 2KB - Virtual size: 2KB

INIT Size: 9KB - Virtual size: 9KB

.rsrc Size: 960B - Virtual size: 936B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 1KB - Virtual size: 1KB

PAGE
Size: 7KB - Virtual size: 7KB

PAGELK
Size: 864B - Virtual size: 842B

.edata
Size: 2KB - Virtual size: 2KB

INIT
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 960B - Virtual size: 936B

.reloc
Size: 1KB - Virtual size: 1KB