Static task
static1
Behavioral task
behavioral1
Sample
cd16b208e0519e8492977d5e35a1c4ff1a2ce3eba93a828bf54830fcb2cd1e3f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cd16b208e0519e8492977d5e35a1c4ff1a2ce3eba93a828bf54830fcb2cd1e3f.dll
Resource
win10v2004-20220812-en
General
-
Target
cd16b208e0519e8492977d5e35a1c4ff1a2ce3eba93a828bf54830fcb2cd1e3f
-
Size
63KB
-
MD5
5f8aeea445a3a278edf3823f836f34ba
-
SHA1
08e67186ec951f8cd67394da8676682ba8e9f341
-
SHA256
cd16b208e0519e8492977d5e35a1c4ff1a2ce3eba93a828bf54830fcb2cd1e3f
-
SHA512
44f9b1550eeb76fbfecaea21fa4980b0259df3e249b4dcea22cac8da421ea3047a60cc33501e120d4af2d6284f4dd9b942a3cae5ad7b20ffb032739774a44ee0
-
SSDEEP
1536:q3vnfW0Jyk0SwatfDvpl7FZrkljnFkisp/:q3HWEfDr7Sjeis
Malware Config
Signatures
Files
-
cd16b208e0519e8492977d5e35a1c4ff1a2ce3eba93a828bf54830fcb2cd1e3f.dll windows x86
d5185fe9fe2fe79cd238b1c3108df36b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PoStartNextPowerIrp
PoSetSystemState
ExReinitializeResourceLite
IoRaiseHardError
ExCreateCallback
RtlInitializeSid
FsRtlDeregisterUncProvider
RtlInitString
ZwCreateKey
IoInvalidateDeviceRelations
RtlEqualString
KeWaitForSingleObject
PoRegisterSystemState
RtlValidSecurityDescriptor
RtlUpperChar
KeInitializeSemaphore
IoReportResourceForDetection
PoSetPowerState
RtlEqualUnicodeString
IoGetCurrentProcess
RtlInitUnicodeString
SeAccessCheck
IoDeviceObjectType
KeReleaseMutex
ExGetSharedWaiterCount
KeInitializeEvent
PsGetCurrentThreadId
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 10KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ