4949d9c07185c4741b9fb7d92e201410N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4949d9c07185c4741b9fb7d92e201410N.exe
Size

51KB
MD5

4949d9c07185c4741b9fb7d92e201410
SHA1

0d3e887bbfc40e7bb11442aea5bfe00a04098b52
SHA256

c1a22ba50cc357682cd07cb229b113930f0b50688b51a6f6b02140fbb8a5d9e2
SHA512

1457ca1bee6cd7dcaf3d6d7f8a546af66b9fc01e52a1d380510c0938f16685ef6d39196530cc589c0c424f831bfff4d83367e4edec0660f67aa91a0f04cad6f7
SSDEEP

1536:yWfknB2aF668C0KjG0a534xxgymmRALkgkCd:HC966Z0rp34fCmRiVkW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4949d9c07185c4741b9fb7d92e201410N.exe

Files

4949d9c07185c4741b9fb7d92e201410N.exe
.dll windows:3 windows x86 arch:x86

70d5c43631187c0ab78f904a045f3de4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeInsertDeviceQueue
DbgPrint
Kei386EoiHelper
KeUpdateSystemTime
KeUpdateRunTime
KeSetTimeIncrement
KiCoprocessorError
KiIpiServiceRoutine
KiUnexpectedInterrupt
KeProfileInterrupt
KeSetEventBoostPriority
KeWaitForSingleObject
KiDeliverApc
KiDispatchInterrupt
RtlZeroMemory
ExAllocatePool
strncpy
_stricmp
RtlMoveMemory
MmMapLockedPages
MmGetPhysicalAddress
MmFreeContiguousMemory
MmAllocateContiguousMemory
RtlFindClearBitsAndSet
KeRemoveDeviceQueue
RtlClearBits
ExFreePool
ZwClose
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
RtlInitUnicodeString
DbgBreakPoint
RtlSetBits
ObfDereferenceObject
KeSetEvent
KeEnterKernelDebugger
MmUnlockPagableImageSection
MmLockPagableDataSection
MmMapIoSpace
RtlSetAllBits
RtlInitializeBitMap
KeInitializeSpinLock
KeInitializeDeviceQueue
ObInsertObject
ObReferenceObjectByPointer
IoAdapterObjectType
ObCreateObject
RtlIntegerToUnicodeString
RtlFillMemory
KiAcquireSpinLock
KiReleaseSpinLock
IoAssignResources
ZwSetValueKey
swprintf
IoReportHalResourceUsage
strstr
HalPrivateDispatchTable
HalDispatchTable
KeBugCheckEx
sprintf
KeFindConfigurationEntry
RtlFreeUnicodeString
MmUnmapIoSpace
KeInitializeEvent
ExAllocatePoolWithTag

Exports

Exports

ExAcquireFastMutex
ExReleaseFastMutex
ExTryToAcquireFastMutex
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAssignSlotResources
HalBeginSystemInterrupt
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalDisableSystemInterrupt
HalDisplayString
HalEnableSystemInterrupt
HalEndSystemInterrupt
HalFlushCommonBuffer
HalFreeCommonBuffer
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetInterruptVector
HalHandleNMI
HalInitSystem
HalInitializeProcessor
HalMakeBeep
HalProcessorIdle
HalQueryDisplayParameters
HalQueryRealTimeClock
HalReadDmaCounter
HalReportResourceUsage
HalRequestIpi
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetProfileInterval
HalSetRealTimeClock
HalSetTimeIncrement
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalTranslateBusAddress
IoAssignDriveLetters
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KdPortGetByte
KdPortInitialize
KdPortPollByte
KdPortPutByte
KdPortRestore
KdPortSave
KeAcquireSpinLock
KeFlushWriteBuffer
KeGetCurrentIrql
KeLowerIrql
KeQueryPerformanceCounter
KeRaiseIrql
KeReleaseSpinLock
KeStallExecutionProcessor
KfAcquireSpinLock
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock
READ_PORT_BUFFER_UCHAR
READ_PORT_BUFFER_ULONG
READ_PORT_BUFFER_USHORT
READ_PORT_UCHAR
READ_PORT_ULONG
READ_PORT_USHORT
WRITE_PORT_BUFFER_UCHAR
WRITE_PORT_BUFFER_ULONG
WRITE_PORT_BUFFER_USHORT
WRITE_PORT_UCHAR
WRITE_PORT_ULONG
WRITE_PORT_USHORT

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT16
Size: 64B - Virtual size: 57B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 864B - Virtual size: 842B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 928B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

70d5c43631187c0ab78f904a045f3de4

Headers

File Characteristics

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 22KB

_TEXT16 Size: 64B - Virtual size: 57B

.data Size: 2KB - Virtual size: 2KB

PAGE Size: 7KB - Virtual size: 7KB

PAGELK Size: 864B - Virtual size: 842B

.edata Size: 2KB - Virtual size: 2KB

INIT Size: 10KB - Virtual size: 10KB

.rsrc Size: 928B - Virtual size: 924B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 22KB - Virtual size: 22KB

_TEXT16
Size: 64B - Virtual size: 57B

.data
Size: 2KB - Virtual size: 2KB

PAGE
Size: 7KB - Virtual size: 7KB

PAGELK
Size: 864B - Virtual size: 842B

.edata
Size: 2KB - Virtual size: 2KB

INIT
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 928B - Virtual size: 924B

.reloc
Size: 1KB - Virtual size: 1KB