Static task
static1
Behavioral task
behavioral1
Sample
ef0efa702ceaacab17d9c5b4336bc51095d2ebbcefd0506b8233e5b6a325ad19.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ef0efa702ceaacab17d9c5b4336bc51095d2ebbcefd0506b8233e5b6a325ad19.dll
Resource
win10v2004-20220901-en
General
-
Target
ef0efa702ceaacab17d9c5b4336bc51095d2ebbcefd0506b8233e5b6a325ad19
-
Size
21KB
-
MD5
0ddb9fa8627bb928bb0d5683a7a59718
-
SHA1
356433338e3cdf49548f1fc888ed6ec6bfe3bf10
-
SHA256
ef0efa702ceaacab17d9c5b4336bc51095d2ebbcefd0506b8233e5b6a325ad19
-
SHA512
5579347c177cc1a79ebd2363729bb29aada7b10060f92589f3eb1e31c2f316390796cc2c16b652e942b09d37ff2d1290206a7e5bceef587fbd416c82169135bd
-
SSDEEP
192:2PtdRCtSaxQxsP3NrfCenZkLXS9p1nJ7VSxtBPZpYmg/pSVjPe7pvOK6xf6ix9:21StLNCq/7kHBVVjmpvOK6Fv
Malware Config
Signatures
Files
-
ef0efa702ceaacab17d9c5b4336bc51095d2ebbcefd0506b8233e5b6a325ad19.dll windows x86
2c577c8f10c1f8f83fa011b49fa93671
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePool
ZwQuerySystemInformation
RtlEqualUnicodeString
PsLookupProcessThreadByCid
KeInitializeApc
ObfReferenceObject
KeInsertQueueApc
memcpy
IoQueueWorkItem
ZwOpenFile
ZwClose
IoAllocateWorkItem
KeInitializeTimer
KeInitializeDpc
KeSetTimer
ZwAllocateVirtualMemory
ExFreePoolWithTag
IoFreeWorkItem
ObfDereferenceObject
hal
KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ