?RemoveDateNew@@IJPAXEEPAF@X
Static task
static1
Behavioral task
behavioral1
Sample
a139d7d80e98c59161b2bf298185b93bb07dc1b3a87a49f078e08ba59289e89a.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a139d7d80e98c59161b2bf298185b93bb07dc1b3a87a49f078e08ba59289e89a.dll
Resource
win10v2004-20220812-en
General
-
Target
a139d7d80e98c59161b2bf298185b93bb07dc1b3a87a49f078e08ba59289e89a
-
Size
445KB
-
MD5
ab8ade81d435d3d09406dfb62218d8b0
-
SHA1
ec441f60f67b4da32adff9c610a6b179b130912e
-
SHA256
a139d7d80e98c59161b2bf298185b93bb07dc1b3a87a49f078e08ba59289e89a
-
SHA512
1ac49dbcb6ea5ea01c7298c1ff6986853e8b22c7a3bdd6ad228fe1a777ca50bf37d1c5ec62f329a79581c498381ed629c9a1c93bcf63b27f99c57216b579a081
-
SSDEEP
12288:eh7f1jBtKy4LE4wxubJ2Li73ZpjgRdKWQ:eh71jiW/MbJ2LO3ZpkRIx
Malware Config
Signatures
Files
-
a139d7d80e98c59161b2bf298185b93bb07dc1b3a87a49f078e08ba59289e89a.dll windows x86
54238a4e6cd8627acd50ac251a1e683f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeWaitForMultipleObjects
IoOpenDeviceRegistryKey
IoSetShareAccess
ObfDereferenceObject
MmFreeContiguousMemory
IoGetDriverObjectExtension
RtlInitializeUnicodePrefix
ZwOpenSymbolicLinkObject
RtlFreeAnsiString
MmFreeMappingAddress
IoSetSystemPartition
ObfReferenceObject
MmFlushImageSection
ObOpenObjectByPointer
IoGetBootDiskInformation
IoBuildPartialMdl
ExGetSharedWaiterCount
IoConnectInterrupt
RtlUnicodeStringToInteger
DbgBreakPoint
MmUnlockPages
IoAllocateWorkItem
ZwCreateKey
IoGetTopLevelIrp
RtlFreeUnicodeString
RtlDowncaseUnicodeString
KeReadStateEvent
ZwCreateEvent
IoGetStackLimits
SeAssignSecurity
CcCanIWrite
ExAcquireFastMutexUnsafe
IoUnregisterFileSystem
IoReleaseRemoveLockEx
PsGetVersion
SeFreePrivileges
KeRemoveDeviceQueue
KeCancelTimer
KeAttachProcess
MmLockPagableSectionByHandle
PoSetPowerState
CcZeroData
IoGetRequestorProcess
ZwSetValueKey
MmUnmapReservedMapping
IoDeleteController
RtlMapGenericMask
KeRevertToUserAffinityThread
PoRequestPowerIrp
ZwQueryVolumeInformationFile
KeReleaseMutex
RtlInitializeGenericTable
WmiQueryTraceInformation
KeRemoveByKeyDeviceQueue
IoReleaseCancelSpinLock
RtlClearBits
SeDeleteObjectAuditAlarm
IoReuseIrp
MmSecureVirtualMemory
SeFilterToken
RtlRandom
RtlValidSecurityDescriptor
RtlIntegerToUnicodeString
RtlCreateAcl
ExRaiseStatus
CcMdlWriteComplete
MmUnlockPagableImageSection
IoQueryDeviceDescription
KeSetTimer
MmSetAddressRangeModified
ZwOpenProcess
MmPageEntireDriver
RtlInitAnsiString
IoDeleteDevice
KeReleaseSemaphore
ZwQueryKey
ExGetPreviousMode
FsRtlLookupLastLargeMcbEntry
RtlGenerate8dot3Name
MmAllocateNonCachedMemory
ExSetResourceOwnerPointer
FsRtlIsNameInExpression
KeLeaveCriticalRegion
RtlSecondsSince1980ToTime
RtlGetVersion
RtlCopyString
RtlTimeToSecondsSince1970
ZwFlushKey
MmMapLockedPages
ExReleaseResourceLite
IoCreateStreamFileObjectLite
KeBugCheck
PsImpersonateClient
RtlWriteRegistryValue
RtlFindLastBackwardRunClear
IofCompleteRequest
RtlSplay
RtlStringFromGUID
KeInitializeTimerEx
RtlFindClearBits
IoGetRelatedDeviceObject
IoFreeController
MmIsDriverVerifying
MmUnsecureVirtualMemory
IoStartPacket
ZwQueryObject
ZwSetVolumeInformationFile
ZwDeviceIoControlFile
IoIsOperationSynchronous
RtlSubAuthoritySid
PoSetSystemState
RtlVerifyVersionInfo
SeValidSecurityDescriptor
IoWritePartitionTableEx
RtlInsertUnicodePrefix
ZwDeleteKey
KeUnstackDetachProcess
IoUpdateShareAccess
KeInitializeDeviceQueue
IoSetPartitionInformationEx
KeQuerySystemTime
ExLocalTimeToSystemTime
ObGetObjectSecurity
RtlTimeToTimeFields
CcPinRead
KeQueryActiveProcessors
RtlDeleteRegistryValue
ExCreateCallback
ExFreePool
RtlCopyUnicodeString
KeRegisterBugCheckCallback
KeInitializeDpc
MmAllocatePagesForMdl
ZwSetSecurityObject
ExAllocatePool
MmLockPagableDataSection
MmBuildMdlForNonPagedPool
ZwAllocateVirtualMemory
IoDisconnectInterrupt
PsGetProcessId
IoReleaseVpbSpinLock
IoReadDiskSignature
IoThreadToProcess
ExFreePoolWithTag
ExDeletePagedLookasideList
FsRtlIsTotalDeviceFailure
IoIsWdmVersionAvailable
ExNotifyCallback
RtlDeleteNoSplay
RtlCreateRegistryKey
ZwPowerInformation
ProbeForRead
CcPreparePinWrite
RtlEqualSid
CcFlushCache
PsRevertToSelf
IoCreateSynchronizationEvent
IoGetRequestorProcessId
PsReturnPoolQuota
RtlLengthSecurityDescriptor
PsGetCurrentThread
ExIsProcessorFeaturePresent
PsLookupProcessByProcessId
ExRaiseDatatypeMisalignment
PoStartNextPowerIrp
ZwWriteFile
RtlCompareUnicodeString
RtlMultiByteToUnicodeN
IoDeleteSymbolicLink
KeInitializeTimer
KeDeregisterBugCheckCallback
IoInitializeIrp
KeRestoreFloatingPointState
ObReferenceObjectByPointer
SeDeassignSecurity
RtlFindClearBitsAndSet
MmMapIoSpace
ZwCreateSection
RtlCopyLuid
ObReferenceObjectByHandle
IoAllocateMdl
ExUnregisterCallback
KeInitializeQueue
ZwMakeTemporaryObject
ZwClose
RtlEnumerateGenericTable
ExDeleteNPagedLookasideList
SeTokenIsAdmin
ZwOpenFile
IofCallDriver
MmFreeNonCachedMemory
KeInsertDeviceQueue
RtlAddAccessAllowedAce
MmHighestUserAddress
MmAllocateContiguousMemory
KeDelayExecutionThread
MmQuerySystemSize
RtlNtStatusToDosError
RtlAreBitsSet
IoSetDeviceToVerify
IoFreeIrp
RtlUnicodeToOemN
RtlAppendStringToString
IoGetAttachedDeviceReference
IoFreeWorkItem
ExReinitializeResourceLite
IoDeviceObjectType
RtlUpperString
PsLookupThreadByThreadId
FsRtlMdlWriteCompleteDev
RtlUnicodeStringToAnsiString
CcPurgeCacheSection
CcMapData
MmAllocateMappingAddress
PsCreateSystemThread
ZwEnumerateValueKey
RtlAreBitsClear
RtlFillMemoryUlong
DbgPrompt
RtlLengthSid
SeQueryAuthenticationIdToken
PoCallDriver
KeInitializeEvent
ZwCreateFile
RtlDelete
CcCopyRead
CcCopyWrite
IoCreateNotificationEvent
FsRtlNotifyUninitializeSync
ZwReadFile
ZwUnloadDriver
IoCsqRemoveIrp
IoFreeErrorLogEntry
KeInsertQueueDpc
IoInvalidateDeviceRelations
DbgBreakPointWithStatus
KeReadStateTimer
CcSetFileSizes
SeCreateClientSecurity
RtlFindNextForwardRunClear
IoStopTimer
CcGetFileObjectFromBcb
PsSetLoadImageNotifyRoutine
KeQueryTimeIncrement
KeGetCurrentThread
ExDeleteResourceLite
MmFreePagesFromMdl
KeStackAttachProcess
ZwQuerySymbolicLinkObject
CcMdlReadComplete
KeInsertByKeyDeviceQueue
RtlQueryRegistryValues
KeRemoveQueueDpc
MmProbeAndLockProcessPages
KeSaveFloatingPointState
RtlCreateSecurityDescriptor
IoGetCurrentProcess
RtlOemStringToUnicodeString
ZwOpenSection
RtlInitializeSid
IoIsSystemThread
Exports
Exports
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ