Static task
static1
Behavioral task
behavioral1
Sample
1cd552c289f00db541a77175bc4cbe0b5f9ef76096800605733116fada699b6e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1cd552c289f00db541a77175bc4cbe0b5f9ef76096800605733116fada699b6e.dll
Resource
win10v2004-20220812-en
General
-
Target
1cd552c289f00db541a77175bc4cbe0b5f9ef76096800605733116fada699b6e
-
Size
378KB
-
MD5
0c765dd9d1497f24567e750246d41b84
-
SHA1
0ce0a71284d0fda71d96db18706488940da6317f
-
SHA256
1cd552c289f00db541a77175bc4cbe0b5f9ef76096800605733116fada699b6e
-
SHA512
9c5210670ec26de2b2d335049f444be789114d9f275aca492f55b611c3ed473a4cfd56514c32a2aa1f484a8a07a56fd5d8fd2483adddc65d7fad21e58151acea
-
SSDEEP
6144:NLZBfRms++k9kNIzk16ffkurOpbDIgFhXYWXMHJyUooBMpacpVnYrZVxWn60u3v9:N3lFQ2KJPcniWgdQsyDS
Malware Config
Signatures
Files
-
1cd552c289f00db541a77175bc4cbe0b5f9ef76096800605733116fada699b6e.dll windows x86
71b21e0f1605aafa751adcc0ece8456e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlFindUnicodePrefix
RtlEqualUnicodeString
MmLockPagableDataSection
CcPreparePinWrite
FsRtlFreeFileLock
RtlCompareString
RtlAnsiStringToUnicodeString
KeWaitForSingleObject
RtlInitUnicodeString
RtlInitString
IoSetThreadHardErrorMode
ZwMakeTemporaryObject
KeQueryActiveProcessors
IoStartPacket
ExGetPreviousMode
RtlEqualString
RtlHashUnicodeString
IoGetDeviceInterfaces
KeSetTimerEx
_wcsupr
RtlInitializeBitMap
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.file Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.type Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ