d0d35247b5036e646824bb9014c743e0N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d0d35247b5036e646824bb9014c743e0N.exe
Size

3KB
MD5

d0d35247b5036e646824bb9014c743e0
SHA1

3cd5380707a6b8fee8fbf9debe72505a11d6df8d
SHA256

2eade856d77e2211805a233c246a47ef8bc24d0db056bb439422e3e6efe3c76a
SHA512

f266d7d6b29e7d461ba647f6f3bb74197c5a22964185650fd8c072a9e6734b9a8664e0780c48e05d8642c35842584b2677a7a39dbbb3f7c124209641f421b67d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0d35247b5036e646824bb9014c743e0N.exe

Files

d0d35247b5036e646824bb9014c743e0N.exe
.dll windows:5 windows x86 arch:x86

9cdf4a89965f45e2d3770fa763a47517

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

FsRtlAllocatePool
ZwDeviceIoControlFile
ZwClose
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
ZwOpenFile
IoRegisterPlugPlayNotification
IoCreateDriver
PsSetCreateThreadNotifyRoutine

Exports

Exports

KdD0Transition
KdD3Transition
KdDebuggerInitialize0
KdDebuggerInitialize1
KdReceivePacket
KdRestore
KdSave
KdSendPacket

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 62B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ