Static task
static1
Behavioral task
behavioral1
Sample
c18ea33d1bd88f03356d5d8b15f677079ede86b06d935548892cf2e26338224e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c18ea33d1bd88f03356d5d8b15f677079ede86b06d935548892cf2e26338224e.dll
Resource
win10v2004-20220812-en
General
-
Target
c18ea33d1bd88f03356d5d8b15f677079ede86b06d935548892cf2e26338224e
-
Size
35KB
-
MD5
747cdac43d57add6a93554071cdf7010
-
SHA1
c1f64410195bf666c31daa549bbe77e2c3fd0ff2
-
SHA256
c18ea33d1bd88f03356d5d8b15f677079ede86b06d935548892cf2e26338224e
-
SHA512
168764f3a063cb817b3fa5d6970a47b6d7af6937993d4f919a24688d90b20493a80e9570f45cdfc8fea07c1c772f75a94551d8be8b48b0365d0b31bd3d18e76f
-
SSDEEP
768:jlCHO5sJBkFL+RogMqOBSzfwgs1/1iGh+4Nl5:hCHbeF6RogMCf5S/oN4Nl5
Malware Config
Signatures
Files
-
c18ea33d1bd88f03356d5d8b15f677079ede86b06d935548892cf2e26338224e.dll windows x86
5f612720184461b842496ea963ba5da2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlIntegerToUnicodeString
IoCreateStreamFileObjectLite
ObReferenceObjectByHandle
RtlCompareString
RtlSetDaclSecurityDescriptor
MmForceSectionClosed
FsRtlFreeFileLock
IoSetSystemPartition
KeInsertQueue
KeInitializeSemaphore
IoOpenDeviceRegistryKey
RtlTimeToSecondsSince1980
KeRundownQueue
MmCanFileBeTruncated
RtlEqualUnicodeString
IoStopTimer
RtlEqualString
RtlInitString
RtlCharToInteger
RtlInitUnicodeString
MmIsDriverVerifying
RtlGetNextRange
RtlQueryRegistryValues
ExAllocatePoolWithQuotaTag
ObReferenceObjectByPointer
MmFreeNonCachedMemory
RtlSetBits
RtlWriteRegistryValue
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ