Static task
static1
Behavioral task
behavioral1
Sample
b1f3c9af322689bb77cc4dc030156cfb59195a66d5df49c6767417cbfaff1d0e.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b1f3c9af322689bb77cc4dc030156cfb59195a66d5df49c6767417cbfaff1d0e.dll
Resource
win10v2004-20220812-en
General
-
Target
b1f3c9af322689bb77cc4dc030156cfb59195a66d5df49c6767417cbfaff1d0e
-
Size
135KB
-
MD5
754cd50b719905f9be2b8292b3cbd3e4
-
SHA1
7ac26273c4a0e48df70c351fff7192c32e045234
-
SHA256
b1f3c9af322689bb77cc4dc030156cfb59195a66d5df49c6767417cbfaff1d0e
-
SHA512
1f127d4ec00a88481870ca446385d766630942ea4f84700252d61719d3cd75c889ee64ec0151ea4e64995c7639dfda2c3a127068609da370d41025cb294f3230
-
SSDEEP
3072:r/r/8RPzNOPCYJKnBWU7ZcY6x0OvLAHh/T6JciDmmUS00x6:rAxpYMWU7Zp6xBAHtjiDUI
Malware Config
Signatures
Files
-
b1f3c9af322689bb77cc4dc030156cfb59195a66d5df49c6767417cbfaff1d0e.dll windows x86
b21a23a1c016c9731491963bdc195bcb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlEqualUnicodeString
ExAcquireFastMutexUnsafe
RtlInitString
FsRtlIsDbcsInExpression
RtlIntegerToUnicodeString
KeInitializeApc
ZwQueryInformationFile
KdEnableDebugger
RtlClearBits
RtlCharToInteger
IoSetDeviceInterfaceState
KeInsertQueue
ExAllocatePoolWithQuotaTag
ExDeleteNPagedLookasideList
RtlInitializeSid
KeSetPriorityThread
KeGetCurrentThread
RtlFindSetBits
RtlInitUnicodeString
ExGetSharedWaiterCount
RtlEqualString
ZwOpenFile
RtlCompareString
SeValidSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwDeviceIoControlFile
KeRemoveByKeyDeviceQueue
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ