Static task
static1
Behavioral task
behavioral1
Sample
0b96a116d92c036f95c70c7e881276411c56f37687ff3faa032cf3c8258bc3df.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b96a116d92c036f95c70c7e881276411c56f37687ff3faa032cf3c8258bc3df.dll
Resource
win10v2004-20220812-en
General
-
Target
0b96a116d92c036f95c70c7e881276411c56f37687ff3faa032cf3c8258bc3df
-
Size
73KB
-
MD5
a279cd19e9502f67f8ed51da8be3b0f3
-
SHA1
c02cdba658a7715cd97eefe02f0a2978a0430164
-
SHA256
0b96a116d92c036f95c70c7e881276411c56f37687ff3faa032cf3c8258bc3df
-
SHA512
147b5122d6a57e96ce614aabaf4fb0f0abc6706f6f44cedc9fb0714cb1019a982419a9aa1d0fd7601e3bfbdb8bccf1c22793e89009c924c2e8330b08b1f76f8a
-
SSDEEP
768:u0I2iwx0CDDcFI8jNrKS/lTzHyRaP3eksNUGEzoVZ3h4MO1Sv1dw7MVRW44cf/QG:u0I2hTAI8DlPyRaPd5hkVNOquMe4f4G
Malware Config
Signatures
Files
-
0b96a116d92c036f95c70c7e881276411c56f37687ff3faa032cf3c8258bc3df.dll windows x86
dbee48f72b3673fdf8617ccc0390cc50
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlEqualString
KeRemoveByKeyDeviceQueue
KeRemoveQueue
RtlInitString
ExFreePoolWithTag
MmIsAddressValid
RtlFindNextForwardRunClear
ZwFsControlFile
CcIsThereDirtyData
IoAllocateIrp
PoSetSystemState
strcat
RtlUpperChar
FsRtlGetNextFileLock
RtlDeleteRegistryValue
ExGetPreviousMode
RtlCreateRegistryKey
RtlIntegerToUnicodeString
RtlSetBits
RtlAppendStringToString
RtlInsertUnicodePrefix
ZwQueryInformationFile
RtlEqualUnicodeString
KeSetImportanceDpc
RtlFillMemoryUlong
RtlCompareString
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ