Static task
static1
Behavioral task
behavioral1
Sample
bbff842b682800f110d2205acf5a0edfb2a9c3a2c6d3faaf6553cfaa074c99cb.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bbff842b682800f110d2205acf5a0edfb2a9c3a2c6d3faaf6553cfaa074c99cb.dll
Resource
win10v2004-20220812-en
General
-
Target
bbff842b682800f110d2205acf5a0edfb2a9c3a2c6d3faaf6553cfaa074c99cb
-
Size
379KB
-
MD5
2e99e773a800e13e99c03d79e30a85c0
-
SHA1
758b752d0ab201057139cb2cee80d54aaf6f7b67
-
SHA256
bbff842b682800f110d2205acf5a0edfb2a9c3a2c6d3faaf6553cfaa074c99cb
-
SHA512
4655294c5c9c072f5e6b0ae4e28afefc69dee150eb70a773b62912d4ff0a80fdd58909c9d29336602032aabf952732ddc2838e6272e49d88d813b5609db3d7c8
-
SSDEEP
6144:PW+g8XeOYHnXjxAXmxCx2LYW2Tz0tfT+zSyrBwsQXF4MbshSylNcyPuBRMfKMk9r:e0JY3RQTzXA1KlwD3MjfP/y
Malware Config
Signatures
Files
-
bbff842b682800f110d2205acf5a0edfb2a9c3a2c6d3faaf6553cfaa074c99cb.dll windows x86
dda46750d779144f8aa2bfb7af65fe31
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExRaiseDatatypeMisalignment
MmFreePagesFromMdl
IoStopTimer
ExSetTimerResolution
RtlUpcaseUnicodeString
ExRegisterCallback
RtlFindClearBitsAndSet
ExFreePool
RtlUpperString
RtlDeleteNoSplay
ExRaiseStatus
CcCopyWrite
MmUnlockPagableImageSection
RtlCompareMemory
MmGetPhysicalAddress
ZwMakeTemporaryObject
RtlFindLastBackwardRunClear
IoGetRequestorProcessId
MmProbeAndLockPages
RtlGetVersion
FsRtlCheckOplock
ZwOpenKey
RtlCreateUnicodeString
MmMapIoSpace
RtlValidSecurityDescriptor
KeInitializeSemaphore
PoStartNextPowerIrp
FsRtlAllocateFileLock
SeAccessCheck
IoRemoveShareAccess
KeReadStateMutex
ZwEnumerateValueKey
SeOpenObjectAuditAlarm
ZwCreateDirectoryObject
IoReleaseCancelSpinLock
IoStartNextPacket
KeQueryTimeIncrement
IoGetDmaAdapter
KeDeregisterBugCheckCallback
RtlFindUnicodePrefix
RtlUnicodeToOemN
PsGetCurrentProcessId
KeSetTimer
PoCallDriver
ZwOpenFile
IoFreeMdl
KeResetEvent
KeReleaseMutex
ZwOpenSymbolicLinkObject
ZwReadFile
RtlxUnicodeStringToAnsiSize
ExLocalTimeToSystemTime
RtlOemStringToUnicodeString
KeSetImportanceDpc
MmLockPagableDataSection
KdEnableDebugger
IoDeleteController
ZwMapViewOfSection
ZwDeleteValueKey
KeInitializeApc
RtlEqualString
RtlFindSetBits
IoReportResourceForDetection
KeWaitForSingleObject
KeRemoveQueue
RtlNtStatusToDosError
KeSynchronizeExecution
SeDeassignSecurity
RtlFindClearBits
SeTokenIsAdmin
ProbeForWrite
KeQueryInterruptTime
KeClearEvent
IoGetStackLimits
RtlRandom
IoFreeController
ExNotifyCallback
IoFreeWorkItem
ZwAllocateVirtualMemory
KeFlushQueuedDpcs
SeCreateClientSecurity
ExAcquireResourceSharedLite
IoDeleteDevice
FsRtlGetNextFileLock
PsGetCurrentThread
RtlCompareString
KeInsertQueue
ZwFsControlFile
RtlQueryRegistryValues
KeGetCurrentThread
RtlCopySid
RtlCreateRegistryKey
RtlValidSid
IoCheckQuotaBufferValidity
IoRegisterDeviceInterface
ZwEnumerateKey
RtlUnicodeStringToInteger
FsRtlFastUnlockSingle
KeSetEvent
KeSetPriorityThread
ExVerifySuite
SeTokenIsRestricted
FsRtlDeregisterUncProvider
KeRegisterBugCheckCallback
RtlTimeFieldsToTime
MmHighestUserAddress
RtlAnsiStringToUnicodeString
KeInsertHeadQueue
RtlSetBits
RtlTimeToSecondsSince1970
RtlRemoveUnicodePrefix
IoInvalidateDeviceRelations
RtlFindMostSignificantBit
ExRaiseAccessViolation
KeInitializeMutex
RtlSecondsSince1980ToTime
IoDeviceObjectType
ObCreateObject
ObQueryNameString
IoInvalidateDeviceState
IoAcquireCancelSpinLock
IoDetachDevice
RtlInitializeGenericTable
CcFastMdlReadWait
MmUnlockPages
IoRequestDeviceEject
CcUnpinDataForThread
SeCaptureSubjectContext
ExGetPreviousMode
CcDeferWrite
IoWriteErrorLogEntry
PsGetCurrentThreadId
RtlLengthSecurityDescriptor
KeStackAttachProcess
MmPageEntireDriver
RtlCreateSecurityDescriptor
RtlInitString
RtlCharToInteger
RtlInitializeUnicodePrefix
DbgBreakPointWithStatus
RtlGetNextRange
IoQueueWorkItem
RtlCopyLuid
KeSetKernelStackSwapEnable
IoSetThreadHardErrorMode
KePulseEvent
RtlUnicodeStringToAnsiString
SeQueryInformationToken
ZwQueryKey
RtlMultiByteToUnicodeN
ZwDeleteKey
RtlSetAllBits
KeWaitForMultipleObjects
ZwFreeVirtualMemory
RtlEnumerateGenericTable
MmAdvanceMdl
PoRequestPowerIrp
PsSetLoadImageNotifyRoutine
KeReadStateEvent
FsRtlCheckLockForReadAccess
RtlFindLeastSignificantBit
IoFreeIrp
MmAllocateNonCachedMemory
RtlWriteRegistryValue
IoCreateNotificationEvent
IoAllocateController
CcCopyRead
MmUnsecureVirtualMemory
MmAllocateContiguousMemory
IoGetDeviceProperty
IoGetDriverObjectExtension
SeSinglePrivilegeCheck
RtlCheckRegistryKey
RtlUpcaseUnicodeToOemN
RtlInitAnsiString
ZwQueryVolumeInformationFile
ZwCreateKey
IoCheckEaBufferValidity
IoInitializeIrp
MmForceSectionClosed
CcRemapBcb
IoGetDeviceInterfaceAlias
MmLockPagableSectionByHandle
ExDeletePagedLookasideList
ExIsProcessorFeaturePresent
IoAttachDeviceToDeviceStack
KeRestoreFloatingPointState
KeRemoveEntryDeviceQueue
MmCanFileBeTruncated
SeDeleteObjectAuditAlarm
RtlEqualUnicodeString
ZwQueryValueKey
PsCreateSystemThread
RtlSubAuthoritySid
FsRtlIsNameInExpression
IoGetDeviceInterfaces
ZwOpenSection
KeInitializeTimerEx
IoCreateFile
PoUnregisterSystemState
ExUnregisterCallback
FsRtlFastCheckLockForRead
FsRtlNotifyUninitializeSync
MmIsVerifierEnabled
ZwCreateFile
ObReferenceObjectByHandle
KeReadStateSemaphore
RtlTimeToSecondsSince1980
CcSetBcbOwnerPointer
KeEnterCriticalRegion
RtlInitializeBitMap
KeInitializeDpc
RtlFindNextForwardRunClear
ExReinitializeResourceLite
RtlSetDaclSecurityDescriptor
IoCreateSymbolicLink
IoGetBootDiskInformation
RtlStringFromGUID
ZwClose
KeRemoveQueueDpc
KeLeaveCriticalRegion
FsRtlIsTotalDeviceFailure
MmSecureVirtualMemory
IoBuildPartialMdl
RtlHashUnicodeString
ExDeleteResourceLite
ObGetObjectSecurity
IoSetShareAccess
IoGetRelatedDeviceObject
FsRtlMdlWriteCompleteDev
IoIsSystemThread
ZwCreateSection
FsRtlIsFatDbcsLegal
ZwQueryObject
KeDelayExecutionThread
IoGetAttachedDevice
PsTerminateSystemThread
RtlUnicodeToMultiByteN
RtlInsertUnicodePrefix
KeQueryActiveProcessors
KeBugCheckEx
IoConnectInterrupt
ExGetSharedWaiterCount
RtlPrefixUnicodeString
PoSetPowerState
RtlFindLongestRunClear
RtlClearAllBits
ObReferenceObjectByPointer
FsRtlFreeFileLock
IoMakeAssociatedIrp
RtlCompareUnicodeString
MmBuildMdlForNonPagedPool
IoAllocateErrorLogEntry
RtlTimeToTimeFields
KeSetTargetProcessorDpc
IoCancelIrp
IoStartTimer
ExSystemTimeToLocalTime
RtlAddAccessAllowedAceEx
RtlLengthRequiredSid
IoDeleteSymbolicLink
IoInitializeTimer
CcPreparePinWrite
Sections
.text Size: 29KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 323B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ