?WoEctobziy@@YGPAXJN@Z
Static task
static1
Behavioral task
behavioral1
Sample
6375ea0ddfc5d38b9b50b2c40158e98f0a3eccae1550dfa2bdfc42333b85b640.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6375ea0ddfc5d38b9b50b2c40158e98f0a3eccae1550dfa2bdfc42333b85b640.dll
Resource
win10v2004-20220901-en
General
-
Target
6375ea0ddfc5d38b9b50b2c40158e98f0a3eccae1550dfa2bdfc42333b85b640
-
Size
41KB
-
MD5
1a4d91476b8339e04a973f90abd86ae5
-
SHA1
7aac1c7ca019160173a8d357d783f9ccdf368b23
-
SHA256
6375ea0ddfc5d38b9b50b2c40158e98f0a3eccae1550dfa2bdfc42333b85b640
-
SHA512
e0c126e761200a5b75ccc67004f99e001aaa201db935dd271fa41d35f834907012db55e47f7fbb19ea46884168f7e78bbdd752caa0cf00d55fc76e6b596d7207
-
SSDEEP
768:Km9iojBaQfCr9ezSLeuxHeExvNxvExTaw+H4+LX:KCIJ9WQvIaw+H4+LX
Malware Config
Signatures
Files
-
6375ea0ddfc5d38b9b50b2c40158e98f0a3eccae1550dfa2bdfc42333b85b640.dll windows x86
f49185edf01bb3852d020bf8b7a74f2b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoCreateSymbolicLink
KeLeaveCriticalRegion
KeRemoveByKeyDeviceQueue
IoRegisterDeviceInterface
CcPreparePinWrite
KeSetTimer
RtlUpperString
IoFreeController
KeReadStateEvent
RtlSetDaclSecurityDescriptor
KeInitializeMutex
RtlSetBits
RtlDowncaseUnicodeString
RtlUpperChar
DbgBreakPointWithStatus
IoReportDetectedDevice
RtlCopySid
IoGetAttachedDeviceReference
KeClearEvent
IoDeleteSymbolicLink
RtlCreateUnicodeString
KeDelayExecutionThread
KeInsertDeviceQueue
IoWMIRegistrationControl
PoSetPowerState
CcCopyWrite
KeSetKernelStackSwapEnable
RtlAnsiStringToUnicodeString
Exports
Exports
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ