Static task
static1
Behavioral task
behavioral1
Sample
495040b5045aa5a1c769afb88a751480f326350e6ad0a770893dd83631020dff.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
495040b5045aa5a1c769afb88a751480f326350e6ad0a770893dd83631020dff.dll
Resource
win10v2004-20220812-en
General
-
Target
495040b5045aa5a1c769afb88a751480f326350e6ad0a770893dd83631020dff
-
Size
253KB
-
MD5
7a218bd9c9bb7812e3dc21c3ba6fd1f6
-
SHA1
7f6719503208d62a9ef655adb4e46c9545b94e8a
-
SHA256
495040b5045aa5a1c769afb88a751480f326350e6ad0a770893dd83631020dff
-
SHA512
b5e7564d5dec541654f860d86ff6a5d60e0649ac1599723d2306668d1943a94d83d8cea9235218487ae9d6aeff4c2ede96a2c4ab5848089235a991efe0e31dfe
-
SSDEEP
6144:4n46wsJ/HdnV1ng0iRMUkHFRCsZAOoqA3:4463J/Hdnrng0WMJHFRCq78
Malware Config
Signatures
Files
-
495040b5045aa5a1c769afb88a751480f326350e6ad0a770893dd83631020dff.dll windows x86
6f993ac42c5de0232b17e9de0547c253
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCopyLuid
RtlHashUnicodeString
RtlInitString
ObReferenceObjectByPointer
RtlInitUnicodeString
KeRemoveDeviceQueue
FsRtlLookupLastLargeMcbEntry
IoCancelIrp
KeInsertDeviceQueue
RtlEqualUnicodeString
RtlEqualString
SeDeleteObjectAuditAlarm
RtlxUnicodeStringToAnsiSize
ExRegisterCallback
IoMakeAssociatedIrp
IoCheckEaBufferValidity
KeInitializeEvent
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.code Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.icode Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fdata Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ