?RemoveDateNew@@IJPAXEEPAF@X
Static task
static1
Behavioral task
behavioral1
Sample
83d00bceed1087f72b043294f7fb12789117d1c19bc1209096b1f22d2c311257.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
83d00bceed1087f72b043294f7fb12789117d1c19bc1209096b1f22d2c311257.dll
Resource
win10v2004-20220812-en
General
-
Target
83d00bceed1087f72b043294f7fb12789117d1c19bc1209096b1f22d2c311257
-
Size
73KB
-
MD5
be7702f58a6f76894fdd9a9157bdb934
-
SHA1
94c2bb16490afaedd9df3a47cf1601b8080d3a46
-
SHA256
83d00bceed1087f72b043294f7fb12789117d1c19bc1209096b1f22d2c311257
-
SHA512
8c458649d0876d549193d0cd63c7c92e2e70bce32a168c5b58319db8ec5566f792f99a53859b7e04699191ff0bb4ab705ac59c469b72838759d51a362b66aacf
-
SSDEEP
1536:qPmh/eUwcFBGi9BxpeXbR2jiwDPpbTvJk:qPqLhAIeLYVzpfhk
Malware Config
Signatures
Files
-
83d00bceed1087f72b043294f7fb12789117d1c19bc1209096b1f22d2c311257.dll windows x86
54238a4e6cd8627acd50ac251a1e683f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeWaitForMultipleObjects
IoOpenDeviceRegistryKey
IoSetShareAccess
ObfDereferenceObject
MmFreeContiguousMemory
IoGetDriverObjectExtension
RtlInitializeUnicodePrefix
ZwOpenSymbolicLinkObject
RtlFreeAnsiString
MmFreeMappingAddress
IoSetSystemPartition
ObfReferenceObject
MmFlushImageSection
ObOpenObjectByPointer
IoGetBootDiskInformation
IoBuildPartialMdl
ExGetSharedWaiterCount
IoConnectInterrupt
RtlUnicodeStringToInteger
DbgBreakPoint
MmUnlockPages
IoAllocateWorkItem
ZwCreateKey
IoGetTopLevelIrp
RtlFreeUnicodeString
RtlDowncaseUnicodeString
KeReadStateEvent
ZwCreateEvent
IoGetStackLimits
SeAssignSecurity
CcCanIWrite
ExAcquireFastMutexUnsafe
IoUnregisterFileSystem
IoReleaseRemoveLockEx
PsGetVersion
SeFreePrivileges
KeRemoveDeviceQueue
KeCancelTimer
KeAttachProcess
MmLockPagableSectionByHandle
PoSetPowerState
CcZeroData
IoGetRequestorProcess
ZwSetValueKey
MmUnmapReservedMapping
IoDeleteController
RtlMapGenericMask
KeRevertToUserAffinityThread
PoRequestPowerIrp
ZwQueryVolumeInformationFile
KeReleaseMutex
RtlInitializeGenericTable
WmiQueryTraceInformation
KeRemoveByKeyDeviceQueue
IoReleaseCancelSpinLock
RtlClearBits
SeDeleteObjectAuditAlarm
IoReuseIrp
MmSecureVirtualMemory
SeFilterToken
RtlRandom
RtlValidSecurityDescriptor
RtlIntegerToUnicodeString
RtlCreateAcl
ExRaiseStatus
CcMdlWriteComplete
MmUnlockPagableImageSection
IoQueryDeviceDescription
KeSetTimer
MmSetAddressRangeModified
ZwOpenProcess
MmPageEntireDriver
RtlInitAnsiString
IoDeleteDevice
KeReleaseSemaphore
ZwQueryKey
ExGetPreviousMode
FsRtlLookupLastLargeMcbEntry
RtlGenerate8dot3Name
MmAllocateNonCachedMemory
ExSetResourceOwnerPointer
FsRtlIsNameInExpression
KeLeaveCriticalRegion
RtlSecondsSince1980ToTime
RtlGetVersion
RtlCopyString
RtlTimeToSecondsSince1970
ZwFlushKey
MmMapLockedPages
ExReleaseResourceLite
IoCreateStreamFileObjectLite
KeBugCheck
PsImpersonateClient
RtlWriteRegistryValue
RtlFindLastBackwardRunClear
IofCompleteRequest
RtlSplay
RtlStringFromGUID
KeInitializeTimerEx
RtlFindClearBits
IoGetRelatedDeviceObject
IoFreeController
MmIsDriverVerifying
MmUnsecureVirtualMemory
IoStartPacket
ZwQueryObject
ZwSetVolumeInformationFile
ZwDeviceIoControlFile
IoIsOperationSynchronous
RtlSubAuthoritySid
PoSetSystemState
RtlVerifyVersionInfo
SeValidSecurityDescriptor
IoWritePartitionTableEx
RtlInsertUnicodePrefix
ZwDeleteKey
KeUnstackDetachProcess
IoUpdateShareAccess
KeInitializeDeviceQueue
IoSetPartitionInformationEx
KeQuerySystemTime
ExLocalTimeToSystemTime
ObGetObjectSecurity
RtlTimeToTimeFields
CcPinRead
KeQueryActiveProcessors
RtlDeleteRegistryValue
ExCreateCallback
ExFreePool
RtlCopyUnicodeString
KeRegisterBugCheckCallback
KeInitializeDpc
MmAllocatePagesForMdl
ZwSetSecurityObject
ExAllocatePool
MmLockPagableDataSection
MmBuildMdlForNonPagedPool
ZwAllocateVirtualMemory
IoDisconnectInterrupt
PsGetProcessId
IoReleaseVpbSpinLock
IoReadDiskSignature
IoThreadToProcess
ExFreePoolWithTag
ExDeletePagedLookasideList
FsRtlIsTotalDeviceFailure
IoIsWdmVersionAvailable
ExNotifyCallback
RtlDeleteNoSplay
RtlCreateRegistryKey
ZwPowerInformation
ProbeForRead
CcPreparePinWrite
RtlEqualSid
CcFlushCache
PsRevertToSelf
IoCreateSynchronizationEvent
IoGetRequestorProcessId
PsReturnPoolQuota
RtlLengthSecurityDescriptor
PsGetCurrentThread
ExIsProcessorFeaturePresent
PsLookupProcessByProcessId
ExRaiseDatatypeMisalignment
PoStartNextPowerIrp
ZwWriteFile
RtlCompareUnicodeString
RtlMultiByteToUnicodeN
IoDeleteSymbolicLink
KeInitializeTimer
KeDeregisterBugCheckCallback
IoInitializeIrp
KeRestoreFloatingPointState
ObReferenceObjectByPointer
SeDeassignSecurity
RtlFindClearBitsAndSet
MmMapIoSpace
ZwCreateSection
RtlCopyLuid
ObReferenceObjectByHandle
IoAllocateMdl
ExUnregisterCallback
KeInitializeQueue
ZwMakeTemporaryObject
ZwClose
RtlEnumerateGenericTable
ExDeleteNPagedLookasideList
SeTokenIsAdmin
ZwOpenFile
IofCallDriver
MmFreeNonCachedMemory
KeInsertDeviceQueue
RtlAddAccessAllowedAce
MmHighestUserAddress
MmAllocateContiguousMemory
KeDelayExecutionThread
MmQuerySystemSize
RtlNtStatusToDosError
RtlAreBitsSet
IoSetDeviceToVerify
IoFreeIrp
RtlUnicodeToOemN
RtlAppendStringToString
IoGetAttachedDeviceReference
IoFreeWorkItem
ExReinitializeResourceLite
IoDeviceObjectType
RtlUpperString
PsLookupThreadByThreadId
FsRtlMdlWriteCompleteDev
RtlUnicodeStringToAnsiString
CcPurgeCacheSection
CcMapData
MmAllocateMappingAddress
PsCreateSystemThread
ZwEnumerateValueKey
RtlAreBitsClear
RtlFillMemoryUlong
DbgPrompt
RtlLengthSid
SeQueryAuthenticationIdToken
PoCallDriver
KeInitializeEvent
ZwCreateFile
RtlDelete
CcCopyRead
CcCopyWrite
IoCreateNotificationEvent
FsRtlNotifyUninitializeSync
ZwReadFile
ZwUnloadDriver
IoCsqRemoveIrp
IoFreeErrorLogEntry
KeInsertQueueDpc
IoInvalidateDeviceRelations
DbgBreakPointWithStatus
KeReadStateTimer
CcSetFileSizes
SeCreateClientSecurity
RtlFindNextForwardRunClear
IoStopTimer
CcGetFileObjectFromBcb
PsSetLoadImageNotifyRoutine
KeQueryTimeIncrement
KeGetCurrentThread
ExDeleteResourceLite
MmFreePagesFromMdl
KeStackAttachProcess
ZwQuerySymbolicLinkObject
CcMdlReadComplete
KeInsertByKeyDeviceQueue
RtlQueryRegistryValues
KeRemoveQueueDpc
MmProbeAndLockProcessPages
KeSaveFloatingPointState
RtlCreateSecurityDescriptor
IoGetCurrentProcess
RtlOemStringToUnicodeString
ZwOpenSection
RtlInitializeSid
IoIsSystemThread
Exports
Exports
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ