Static task
static1
Behavioral task
behavioral1
Sample
128a473b8a4672892bb2c246cc0e6440293dcfe606fe37a79ea44b4003ec4397.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
128a473b8a4672892bb2c246cc0e6440293dcfe606fe37a79ea44b4003ec4397.dll
Resource
win10v2004-20221111-en
General
-
Target
128a473b8a4672892bb2c246cc0e6440293dcfe606fe37a79ea44b4003ec4397
-
Size
81KB
-
MD5
d4d9e181dd9a6221de7e5ac4f040a830
-
SHA1
25cf282195da94e37e60ca1351ca0714bde7a81a
-
SHA256
128a473b8a4672892bb2c246cc0e6440293dcfe606fe37a79ea44b4003ec4397
-
SHA512
f8567745217873fd5986d6231cb1bffc1a117a709a02b966e018718a4ca1f58268dc78fc0e1ccb3e68eb67dfa5c6341d7a48983a0b756af717e7783b11d71670
-
SSDEEP
768:PC+dgNlxsg7eF7pcHFLtmZItBhWlMRg7IauHt2TTRdBoJXMSu7MKn:PC+dKT97epaH5tmZZN7ILQTd/
Malware Config
Signatures
Files
-
128a473b8a4672892bb2c246cc0e6440293dcfe606fe37a79ea44b4003ec4397.dll windows x86
735f77450ad79b237f14e52300e8fd15
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoStopTimer
RtlGetNextRange
KeRegisterBugCheckCallback
RtlPrefixUnicodeString
IoSetShareAccess
IoGetDeviceObjectPointer
RtlFindMostSignificantBit
IoAllocateIrp
ZwQueryVolumeInformationFile
ExVerifySuite
MmIsDriverVerifying
KeInitializeDeviceQueue
RtlSetAllBits
KeClearEvent
MmCanFileBeTruncated
ExRaiseDatatypeMisalignment
MmQuerySystemSize
ZwQueryKey
PsLookupThreadByThreadId
RtlUnicodeToMultiByteN
RtlQueryRegistryValues
IoCheckShareAccess
MmSecureVirtualMemory
FsRtlNotifyUninitializeSync
RtlxUnicodeStringToAnsiSize
RtlTimeToSecondsSince1970
IoGetDeviceProperty
ExAcquireResourceSharedLite
SeQueryInformationToken
RtlEqualString
IoQueueWorkItem
MmSizeOfMdl
RtlAnsiStringToUnicodeString
KeSetTargetProcessorDpc
ZwMapViewOfSection
CcDeferWrite
ExDeleteNPagedLookasideList
SeTokenIsAdmin
PoSetPowerState
IoDisconnectInterrupt
ObReferenceObjectByHandle
KeSetImportanceDpc
RtlInitString
IoRemoveShareAccess
MmIsAddressValid
IoAllocateErrorLogEntry
PoSetSystemState
IoInvalidateDeviceRelations
KdEnableDebugger
SeCaptureSubjectContext
RtlEqualSid
KeRestoreFloatingPointState
MmAdvanceMdl
KeUnstackDetachProcess
ObReleaseObjectSecurity
FsRtlSplitLargeMcb
IoAllocateMdl
KeInsertHeadQueue
FsRtlCheckOplock
RtlGetVersion
PsLookupProcessByProcessId
FsRtlDeregisterUncProvider
KeSetTimerEx
KeRemoveByKeyDeviceQueue
IoIsWdmVersionAvailable
KeInitializeSemaphore
RtlAddAccessAllowedAceEx
RtlCheckRegistryKey
PsSetLoadImageNotifyRoutine
RtlFindUnicodePrefix
RtlDeleteNoSplay
ExLocalTimeToSystemTime
IoCreateSynchronizationEvent
RtlFindSetBits
MmGetSystemRoutineAddress
PoRequestPowerIrp
MmFreeContiguousMemory
ZwQueryInformationFile
ZwOpenSymbolicLinkObject
ExAllocatePoolWithQuotaTag
RtlAreBitsSet
FsRtlGetNextFileLock
PsCreateSystemThread
KeSetPriorityThread
IoGetAttachedDeviceReference
ObCreateObject
KeRemoveEntryDeviceQueue
ExAcquireFastMutexUnsafe
SeCreateClientSecurity
KeDeregisterBugCheckCallback
KeBugCheckEx
FsRtlFastCheckLockForRead
IoInvalidateDeviceState
PsTerminateSystemThread
ExReinitializeResourceLite
CcSetBcbOwnerPointer
ExUuidCreate
KeQueryInterruptTime
RtlTimeToSecondsSince1980
RtlDeleteRegistryValue
IoGetBootDiskInformation
IoAcquireCancelSpinLock
RtlCreateSecurityDescriptor
MmFreeNonCachedMemory
SeAccessCheck
RtlClearAllBits
MmUnmapLockedPages
KeSynchronizeExecution
MmFreePagesFromMdl
FsRtlNotifyInitializeSync
KeSetBasePriorityThread
RtlFillMemoryUlong
ZwOpenProcess
RtlInitializeGenericTable
FsRtlIsNameInExpression
CcIsThereDirtyData
IoStartPacket
IoCreateSymbolicLink
RtlGUIDFromString
RtlAppendStringToString
IoSetHardErrorOrVerifyDevice
PoUnregisterSystemState
RtlInitializeSid
KeLeaveCriticalRegion
RtlInt64ToUnicodeString
MmMapIoSpace
IoReleaseCancelSpinLock
KeReadStateTimer
ExAllocatePoolWithTag
ExSystemTimeToLocalTime
KeWaitForMultipleObjects
IoSetThreadHardErrorMode
SeImpersonateClientEx
RtlFindLongestRunClear
SeOpenObjectAuditAlarm
FsRtlAllocateFileLock
KeReleaseMutex
ZwQuerySymbolicLinkObject
ExDeleteResourceLite
KeDelayExecutionThread
RtlInitAnsiString
MmSetAddressRangeModified
ObGetObjectSecurity
KeRundownQueue
FsRtlCheckLockForWriteAccess
CcCopyRead
SeSinglePrivilegeCheck
PsDereferencePrimaryToken
IoCheckEaBufferValidity
IoGetDeviceInterfaceAlias
RtlUpperChar
ZwMakeTemporaryObject
ExReleaseFastMutexUnsafe
MmGetPhysicalAddress
IoBuildSynchronousFsdRequest
RtlCopyString
ZwOpenKey
CcRemapBcb
IoGetCurrentProcess
IoIsSystemThread
KeInsertQueue
IoDeleteController
IoRaiseHardError
CcFastMdlReadWait
IoWMIRegistrationControl
RtlRemoveUnicodePrefix
ExInitializeResourceLite
ExFreePoolWithTag
SeDeassignSecurity
KePulseEvent
KeEnterCriticalRegion
IoConnectInterrupt
RtlTimeToTimeFields
ExDeletePagedLookasideList
MmForceSectionClosed
IoCreateFile
IoCreateNotificationEvent
CcCopyWrite
ExRaiseAccessViolation
ExFreePool
IoAttachDeviceToDeviceStack
IoGetAttachedDevice
RtlCompareUnicodeString
FsRtlCheckLockForReadAccess
IoReportResourceForDetection
RtlFindClearBits
ExGetSharedWaiterCount
CcPreparePinWrite
IoGetDeviceInterfaces
MmUnmapIoSpace
MmUnsecureVirtualMemory
IoCheckQuotaBufferValidity
RtlFreeAnsiString
ExRegisterCallback
RtlInitializeUnicodePrefix
RtlStringFromGUID
ZwFreeVirtualMemory
KeReadStateEvent
RtlRandom
IoWriteErrorLogEntry
IoGetDeviceToVerify
RtlInsertUnicodePrefix
KeReadStateMutex
CcUnpinDataForThread
ZwDeleteKey
IoAllocateWorkItem
KeReadStateSemaphore
IoGetRequestorProcessId
IoDeleteSymbolicLink
RtlCopyUnicodeString
RtlAppendUnicodeToString
MmAllocateContiguousMemory
PoCallDriver
KeInitializeTimer
KeRemoveQueueDpc
IoRegisterDeviceInterface
ZwQueryValueKey
IoSetDeviceInterfaceState
ZwCreateDirectoryObject
KeInitializeEvent
IoAllocateController
ZwDeviceIoControlFile
IoRequestDeviceEject
MmBuildMdlForNonPagedPool
MmLockPagableDataSection
ExIsProcessorFeaturePresent
ExGetExclusiveWaiterCount
IoStartTimer
MmUnlockPagableImageSection
KeSetEvent
FsRtlFastUnlockSingle
RtlMultiByteToUnicodeN
KeStackAttachProcess
KeInitializeSpinLock
CcFastCopyWrite
KeSetTimer
RtlOemStringToUnicodeString
MmIsVerifierEnabled
RtlFindClearRuns
IoMakeAssociatedIrp
KeInsertQueueDpc
KeInitializeTimerEx
RtlFindLastBackwardRunClear
MmUnlockPages
KeQuerySystemTime
RtlUpperString
RtlTimeFieldsToTime
ZwClose
PsGetCurrentProcessId
ExSetTimerResolution
RtlInitializeBitMap
PsIsThreadTerminating
RtlCopySid
RtlLengthSecurityDescriptor
RtlValidSid
IoReuseIrp
IoCreateDevice
RtlUpcaseUnicodeString
IoDeviceObjectType
RtlFindLeastSignificantBit
IoFreeMdl
FsRtlFreeFileLock
KeInsertByKeyDeviceQueue
Sections
.text Size: 27KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 614B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ