Static task
static1
Behavioral task
behavioral1
Sample
ba0001a057ab401fbff865e7eb48889af5166e63236a3a9a57302c21d1deb1f8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ba0001a057ab401fbff865e7eb48889af5166e63236a3a9a57302c21d1deb1f8.dll
Resource
win10v2004-20220901-en
General
-
Target
ba0001a057ab401fbff865e7eb48889af5166e63236a3a9a57302c21d1deb1f8
-
Size
135KB
-
MD5
04a0878482e6e165daff0dd773a7e032
-
SHA1
d189e6aafccc00b996c98f6a3552a00d5b3e76ac
-
SHA256
ba0001a057ab401fbff865e7eb48889af5166e63236a3a9a57302c21d1deb1f8
-
SHA512
05dc0e8abd134e1833e819871db68d5f0e8267c3402ff1374c347f7f0b8488991569091f2294a3b16364cff139cdc2dbe5512623fb1dd3397eedb6d210b71c0b
-
SSDEEP
3072:hr1C20cgBq9TVQLFWU7ZEAi0Gv7YHZE76VuLFUSfSEp:d009TkFWU7Zpi5YHaVLa7
Malware Config
Signatures
Files
-
ba0001a057ab401fbff865e7eb48889af5166e63236a3a9a57302c21d1deb1f8.dll windows x86
3dea1245eb14014c6ba6b75460387ca8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoCheckQuotaBufferValidity
IoGetDeviceProperty
IoGetAttachedDeviceReference
RtlEqualUnicodeString
MmUnmapLockedPages
IoOpenDeviceRegistryKey
RtlCreateRegistryKey
ExReinitializeResourceLite
RtlInitUnicodeString
ExLocalTimeToSystemTime
IoBuildSynchronousFsdRequest
RtlFindLeastSignificantBit
ExSystemTimeToLocalTime
IoReleaseCancelSpinLock
RtlRandom
RtlTimeFieldsToTime
IoCreateNotificationEvent
ObCreateObject
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itab Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.etab Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msd3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msd1 Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.msd2 Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msd4 Size: 512B - Virtual size: 402B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ