Static task
static1
Behavioral task
behavioral1
Sample
64cb94bf690f391fa045076b76766c504701ba6b2f6588900dba37566a5b9b9e.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
64cb94bf690f391fa045076b76766c504701ba6b2f6588900dba37566a5b9b9e.dll
Resource
win10v2004-20231025-en
General
-
Target
64cb94bf690f391fa045076b76766c504701ba6b2f6588900dba37566a5b9b9e
-
Size
77KB
-
MD5
78a654eea6237032cb84865aec4c3363
-
SHA1
445371bee20fb4e2337a84f86b954b44bf2b63f0
-
SHA256
64cb94bf690f391fa045076b76766c504701ba6b2f6588900dba37566a5b9b9e
-
SHA512
8afe947ce02a39c22a912e46e54f188d7fabed769013a63337957ccf37fc92d6ec7e23e9981b9a456ee94a93418b7de23d6769a54bc47da0dfdea924718bc974
-
SSDEEP
1536:ohgKG6ed9yhhkFqXn0vDywaKJxTv1CKPTFuQHa:ohg6ed9yh2Y0vD1aETv10Q6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64cb94bf690f391fa045076b76766c504701ba6b2f6588900dba37566a5b9b9e
Files
-
64cb94bf690f391fa045076b76766c504701ba6b2f6588900dba37566a5b9b9e.dll windows:5 windows x64
4941946d51c13150342706a111de6dca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
ExFreePoolWithTag
strlen
ExAllocatePool
RtlCompareMemory
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ExAllocatePoolWithTag
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
__C_specific_handler
atoi
strstr
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
_vsnprintf
CmUnRegisterCallback
CmRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
PsCreateSystemThread
IoCreateSymbolicLink
RtlUnicodeStringToAnsiString
_vsnwprintf
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
ObQueryNameString
RtlFreeAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ