MemoriBooting_KeyLogger_2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MemoriBooting_KeyLogger_2
Size

5.6MB
MD5

8cff99f0f25cd9dfb0b43a670c620a9e
SHA1

038f426cb130ba8418008b53a25b8c6b86d9e42e
SHA256

d53719dc083feed02ed81aa2cbbb34afb8bbc019c12934a574a23d805089d194
SHA512

3e17822ccd91852e98307a0b5ffe2e54057b5dd9fa8bcc1d7e6baa0c586ce0b1b47fe7a0b0f4d93f2781472c4cfbaab1207f4eff3fe065ef9128b6bacf584878
SSDEEP

49152:yOwbiyNbpY+Qu1MQnOt1Y6KeqHfk7qM/6RzPiPmWPwafLhkkQthfgdOqzAHvHpBg:q3xku9SlPuf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MemoriBooting_KeyLogger_2

Files

MemoriBooting_KeyLogger_2
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ