Static task
static1
Behavioral task
behavioral1
Sample
6a5a7d76806bb17351e88ec9a312bf46af5510e5bbb9227701e6fb2c50d6d97d.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
6a5a7d76806bb17351e88ec9a312bf46af5510e5bbb9227701e6fb2c50d6d97d.dll
Resource
win10v2004-20231023-en
General
-
Target
6a5a7d76806bb17351e88ec9a312bf46af5510e5bbb9227701e6fb2c50d6d97d
-
Size
82KB
-
MD5
fc31f07dc2aa14d4353a5cbcd115317b
-
SHA1
ae3ae6eb15171b2de701ee01bd777dfbea5d0fc5
-
SHA256
6a5a7d76806bb17351e88ec9a312bf46af5510e5bbb9227701e6fb2c50d6d97d
-
SHA512
2cf51b6e865a349075290f4deae239d01926f89d98c9a683f11b3e47ebaa8fab0a0b11fd421cf2df02ee2fa907080ee678bb965694bdbf7e1398381bcd169ba6
-
SSDEEP
1536:3+pMQP7ed9yFjMMvgr2+cvp1/VbI/Lv54woA+W+:3+Waed9y1vgDcvp1/VuLvMW+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a5a7d76806bb17351e88ec9a312bf46af5510e5bbb9227701e6fb2c50d6d97d
Files
-
6a5a7d76806bb17351e88ec9a312bf46af5510e5bbb9227701e6fb2c50d6d97d.dll windows:5 windows x64
f7c7ef9400b8098dce97db6d394e13fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
RtlCompareMemory
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ExAllocatePoolWithTag
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
ExAllocatePool
ZwQueryValueKey
__C_specific_handler
atoi
strstr
_vsnprintf
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
CmUnRegisterCallback
CmRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
PsCreateSystemThread
IoCreateSymbolicLink
RtlUnicodeStringToAnsiString
_vsnwprintf
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
KeDelayExecutionThread
ObQueryNameString
RtlFreeAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
strlen
RtlInitAnsiString
ExFreePoolWithTag
fltmgr.sys
FltStartFiltering
FltRegisterFilter
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ