Static task
static1
Behavioral task
behavioral1
Sample
ecc1ac52cc6b0cfe95af3bb85d52eb96abc583d9d16a6808f9788db4d501f706.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ecc1ac52cc6b0cfe95af3bb85d52eb96abc583d9d16a6808f9788db4d501f706.dll
Resource
win10v2004-20221111-en
General
-
Target
ecc1ac52cc6b0cfe95af3bb85d52eb96abc583d9d16a6808f9788db4d501f706
-
Size
378KB
-
MD5
85c7061aa47f8569720f9cda0923a560
-
SHA1
b462445fab0f3832a46ec63ab210be110ffbe01a
-
SHA256
ecc1ac52cc6b0cfe95af3bb85d52eb96abc583d9d16a6808f9788db4d501f706
-
SHA512
cf5a6448f30aa9606d632ce7ab37ccf7bd980167a2a6213cb88b71be59632d4653dae7bba0121579ae013b6bdef83e38b4543160859df27bccedbe174cabea54
-
SSDEEP
6144:k4i4Le+k9kNIzk16ffkurOpbDIgFhcYWXMHJyUooBMpacpVnYrZVxWn60u3vzNLi:kGBQ1KJPcniWgdQsyES
Malware Config
Signatures
Files
-
ecc1ac52cc6b0cfe95af3bb85d52eb96abc583d9d16a6808f9788db4d501f706.dll windows x86
048e60a4b39e8f9423868e3b12db0fd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeEvent
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
ExAllocatePool
ExFreePoolWithTag
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
NtOpenFile
NtQueryVolumeInformationFile
NtClose
swprintf
RtlInitUnicodeString
ObReferenceObjectByHandle
IoGetRelatedDeviceObject
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExAcquireResourceSharedLite
ZwCreateFile
IoGetStackLimits
MmFlushImageSection
CcInitializeCacheMap
CcPurgeCacheSection
CcSetFileSizes
ZwClose
MmMapLockedPagesSpecifyCache
CcFlushCache
CcUninitializeCacheMap
IofCallDriver
IofCompleteRequest
IoSetInformation
CcCopyWrite
FsRtlCopyRead
IoCreateDevice
ZwAllocateVirtualMemory
ZwQuerySystemInformation
_stricmp
ZwOpenThread
ZwQueryInformationThread
PsLookupProcessByProcessId
PsGetProcessPeb
KeStackAttachProcess
ProbeForRead
RtlEqualUnicodeString
ExDeleteResourceLite
PsLookupProcessThreadByCid
KeInitializeApc
ObfReferenceObject
KeInsertQueueApc
KeDelayExecutionThread
PsCreateSystemThread
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwOpenFile
ZwQueryObject
ZwQueryInformationFile
ZwDeviceIoControlFile
ZwCreateSymbolicLinkObject
ZwCreateDirectoryObject
ZwWriteFile
ZwCreateSection
IoGetCurrentProcess
ZwOpenSection
ZwMapViewOfSection
MmAllocatePagesForMdl
MmUnmapLockedPages
MmFreePagesFromMdl
ZwUnmapViewOfSection
RtlHashUnicodeString
ZwReadFile
IoFreeIrp
KeSetEvent
RtlPrefixUnicodeString
IoAllocateIrp
KeWaitForSingleObject
ExAllocatePoolWithTag
ZwEnumerateKey
ZwDeleteKey
PoStartNextPowerIrp
PoCallDriver
ZwFlushVirtualMemory
ZwQueryKey
ZwSetSystemInformation
IoCreateDriver
ObMakeTemporaryObject
ZwDeleteFile
ObReferenceObjectByName
IoDriverObjectType
IoEnumerateDeviceObjectList
wcsrchr
ExInitializeResourceLite
IoQueryFileInformation
KeUnstackDetachProcess
ObfDereferenceObject
_allmul
_except_handler3
memcpy
memset
hal
KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ