Static task
static1
Behavioral task
behavioral1
Sample
4c30203baaa44a4991737283b7862e2a2d9498004477992af10753dbfb04e777.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4c30203baaa44a4991737283b7862e2a2d9498004477992af10753dbfb04e777.dll
Resource
win10v2004-20231023-en
General
-
Target
4c30203baaa44a4991737283b7862e2a2d9498004477992af10753dbfb04e777
-
Size
98KB
-
MD5
999573072a9f4875579534f5103b95cf
-
SHA1
f7292b098a75a92a7e20688226d18f45eac780bd
-
SHA256
4c30203baaa44a4991737283b7862e2a2d9498004477992af10753dbfb04e777
-
SHA512
ca5e8016104b1f8d1122da0308df0e6ff57849861016bf0be4791264734c017fa69eaf4b45faa2c254b9dfcfa6af3a6cf95bd4d7f24504b240c963aa7ba79c3d
-
SSDEEP
1536:/j0+wMr0RXObed9yKzctjTgxFhvwgvU0sAiUQvqLslR5WSAhEv5PKvueykd:/j0pLaed9yKzwGvvvlxQveslRbhvEP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c30203baaa44a4991737283b7862e2a2d9498004477992af10753dbfb04e777
Files
-
4c30203baaa44a4991737283b7862e2a2d9498004477992af10753dbfb04e777.dll windows:5 windows x64
54c54755b12a66419408bb383c3776e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
IoDetachDevice
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType
RtlInitUnicodeString
strstr
RtlCompareMemory
ExAllocatePoolWithTag
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ExAllocatePool
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
MmMapLockedPagesSpecifyCache
_strnicmp
MmBuildMdlForNonPagedPool
IoAllocateMdl
_vsnprintf
__C_specific_handler
atoi
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoFreeMdl
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
CmUnRegisterCallback
CmRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
PsCreateSystemThread
IoCreateSymbolicLink
RtlUnicodeStringToAnsiString
_vsnwprintf
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
ObQueryNameString
RtlFreeAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
strlen
ZwQueryKey
ExFreePoolWithTag
fltmgr.sys
FltStartFiltering
FltRegisterFilter
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ