Static task
static1
Behavioral task
behavioral1
Sample
1f1f8cddb250eff42d36f540dd26390584d80a04ac630735d5320e30b16967ec.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1f1f8cddb250eff42d36f540dd26390584d80a04ac630735d5320e30b16967ec.dll
Resource
win10v2004-20220812-en
General
-
Target
1f1f8cddb250eff42d36f540dd26390584d80a04ac630735d5320e30b16967ec
-
Size
55KB
-
MD5
08f010302e66ab310a50e2bfaebf9cfa
-
SHA1
3634b0661a5fc05fe9d2e1bccabfdb4f9afdd181
-
SHA256
1f1f8cddb250eff42d36f540dd26390584d80a04ac630735d5320e30b16967ec
-
SHA512
8e4be50da292705b1d1fd2a965bc07362cc45c3a3b75a07b10be3d92146cb1e1e974725c930129b839031a27d9931609afcdb35a5f0e728eb7b864ca62d36193
-
SSDEEP
768:EDH5Q61W0gDNXHbJyj8H0FHNTcBMKH09Kb9yph0Lbxo4L8AVjZMdG9lxwxpeVS:y5Q61F2XHNy00NT6pH0IBLbx62sGne4S
Malware Config
Signatures
Files
-
1f1f8cddb250eff42d36f540dd26390584d80a04ac630735d5320e30b16967ec.dll windows x86
ee7f5ca2cf4849aea29e43368fa60451
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExDeleteNPagedLookasideList
ZwEnumerateValueKey
KeInsertByKeyDeviceQueue
RtlLengthSecurityDescriptor
SeCreateClientSecurity
ZwDeviceIoControlFile
KeSetTargetProcessorDpc
MmBuildMdlForNonPagedPool
RtlCompareString
RtlInitUnicodeString
KeWaitForSingleObject
RtlEnumerateGenericTable
ZwMakeTemporaryObject
IoAllocateIrp
RtlEqualUnicodeString
CcIsThereDirtyData
ZwFlushKey
ExGetPreviousMode
strcat
RtlAppendUnicodeToString
KePulseEvent
RtlEqualString
FsRtlIsDbcsInExpression
RtlIntegerToUnicodeString
RtlInitString
RtlUpperChar
PoRequestPowerIrp
RtlFindLastBackwardRunClear
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ