Static task
static1
Behavioral task
behavioral1
Sample
19ce703b81193f810ddd89d97645f8c8b57dac4139596e87e709f2361293dfae.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
19ce703b81193f810ddd89d97645f8c8b57dac4139596e87e709f2361293dfae.dll
Resource
win10v2004-20220812-en
General
-
Target
19ce703b81193f810ddd89d97645f8c8b57dac4139596e87e709f2361293dfae
-
Size
41KB
-
MD5
33f5acec8861d9bd6c90cbe23d61489e
-
SHA1
635c8b16816f77aac0e450a94c872a0f15c30405
-
SHA256
19ce703b81193f810ddd89d97645f8c8b57dac4139596e87e709f2361293dfae
-
SHA512
b1f19bffea632abb3af6c6f0a4c88af9efc3d95eaf091bb2d2920d4d6f0dd12552ab3773884e2e79158132c77fc19313c065db09dcc02701e658a6f58e91e926
-
SSDEEP
768:vaT3qMr9FydR3g+xu0/Hcu5gijuj9HKT43I+SHiv:4aMr9F+7um8EgijMb3Ai
Malware Config
Signatures
Files
-
19ce703b81193f810ddd89d97645f8c8b57dac4139596e87e709f2361293dfae.dll windows x86
004f33c5f1f245cfa8c7d5c15de86f90
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoGetDriverObjectExtension
IoCheckEaBufferValidity
ExRegisterCallback
IoDeleteDevice
RtlLengthRequiredSid
RtlEqualString
KeStackAttachProcess
RtlAddAccessAllowedAceEx
RtlCompareString
MmAllocateNonCachedMemory
RtlCompareMemory
RtlInitializeBitMap
RtlInitUnicodeString
ZwOpenProcess
KeReleaseMutex
RtlEqualUnicodeString
FsRtlMdlWriteCompleteDev
IoGetRequestorProcessId
KeDeregisterBugCheckCallback
IoIsWdmVersionAvailable
RtlInitString
RtlCreateSecurityDescriptor
FsRtlLookupLastLargeMcbEntry
ZwFlushKey
RtlStringFromGUID
KeSetTimer
atoi
KeQueryTimeIncrement
IoInitializeTimer
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 780B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ