Static task
static1
Behavioral task
behavioral1
Sample
5aeced5504fe8bcdc3f53a736dc3287775a9e60a5767eeacc36bb917cb81c248.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
5aeced5504fe8bcdc3f53a736dc3287775a9e60a5767eeacc36bb917cb81c248.dll
Resource
win10v2004-20231023-en
General
-
Target
5aeced5504fe8bcdc3f53a736dc3287775a9e60a5767eeacc36bb917cb81c248
-
Size
77KB
-
MD5
ef898953618edb8ecda77bda086c1517
-
SHA1
fa1283d61cb3d4e431596aa0b41a920300b8414b
-
SHA256
5aeced5504fe8bcdc3f53a736dc3287775a9e60a5767eeacc36bb917cb81c248
-
SHA512
a7c5641f7ff2e23b6b15cce97cff2e327b5e57fc46a88cd1f5db5f2325b79f385a74d02290fefcf7e4230e64e406cf28b3797f3b1b681bdc686197a0042cf53e
-
SSDEEP
1536:0QgLLNDuDed9yFNuv705VavTXC9Hg/by3U19aJ:0QGWed9yyv7AavbC9KdaJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5aeced5504fe8bcdc3f53a736dc3287775a9e60a5767eeacc36bb917cb81c248
Files
-
5aeced5504fe8bcdc3f53a736dc3287775a9e60a5767eeacc36bb917cb81c248.dll windows:5 windows x64
f282a49029e1552e7c61d0f09b88a3fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
RtlCompareMemory
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ExAllocatePoolWithTag
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
ExAllocatePool
ZwQueryValueKey
__C_specific_handler
atoi
strstr
_vsnprintf
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
CmUnRegisterCallback
CmRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
PsCreateSystemThread
IoCreateSymbolicLink
RtlUnicodeStringToAnsiString
_vsnwprintf
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
KeDelayExecutionThread
ObQueryNameString
RtlFreeAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
strlen
RtlInitAnsiString
ExFreePoolWithTag
fltmgr.sys
FltStartFiltering
FltRegisterFilter
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ