Static task
static1
Behavioral task
behavioral1
Sample
3c73c4f8226d6048139439dfcd4c5edd0099e0fc3e4260c61cdbbd8f358a6bee.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3c73c4f8226d6048139439dfcd4c5edd0099e0fc3e4260c61cdbbd8f358a6bee.dll
Resource
win10v2004-20220812-en
General
-
Target
3c73c4f8226d6048139439dfcd4c5edd0099e0fc3e4260c61cdbbd8f358a6bee
-
Size
331KB
-
MD5
17e89c89122e833ff825d6c27418f4f6
-
SHA1
d04b02eb6f9d5a569fc0ee2b4528217b88da0d8b
-
SHA256
3c73c4f8226d6048139439dfcd4c5edd0099e0fc3e4260c61cdbbd8f358a6bee
-
SHA512
9f1c2d6265feab3acc0e4879f6876c5abc44366a099967e0a29f1d48065a2b33fe051aa6270225bf532b5cea449da9a6fbc4d41e130f461f2350dc558acca6b3
-
SSDEEP
6144:EvhoJUcD5VURwqIEhDAep/gEubrw4pmDh9jNfQJR/1l+7UuWNKH/jzIRkQ0dWih0:qeJzHURwdEXpYrVpmt9jy1l+7xWsH/ja
Malware Config
Signatures
Files
-
3c73c4f8226d6048139439dfcd4c5edd0099e0fc3e4260c61cdbbd8f358a6bee.dll windows x86
49386c74d967dc43d26217bb80a61349
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeCancelTimer
RtlEqualString
ExUuidCreate
RtlCompareString
MmMapLockedPagesSpecifyCache
strncpy
ExFreePoolWithTag
RtlFindSetBits
MmSetAddressRangeModified
RtlCharToInteger
RtlIntegerToUnicodeString
RtlInitUnicodeString
CcRemapBcb
KeInitializeTimerEx
SeDeleteObjectAuditAlarm
RtlTimeFieldsToTime
KeWaitForSingleObject
RtlInitString
IoSetDeviceInterfaceState
RtlEqualUnicodeString
IoFreeIrp
IoDeleteDevice
SeImpersonateClientEx
KeRestoreFloatingPointState
IoAcquireCancelSpinLock
RtlCopyLuid
IoStopTimer
MmMapIoSpace
ZwOpenKey
Sections
.text Size: 23KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ