Static task
static1
Behavioral task
behavioral1
Sample
80f094059bb6e3b3d59537f1328081ce7782c2a1ea5d1c88956c28a99ea90f55.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
80f094059bb6e3b3d59537f1328081ce7782c2a1ea5d1c88956c28a99ea90f55.dll
Resource
win10v2004-20231020-en
General
-
Target
80f094059bb6e3b3d59537f1328081ce7782c2a1ea5d1c88956c28a99ea90f55
-
Size
80KB
-
MD5
d6e3117c8ec51e53eca6b658ba360826
-
SHA1
8de4f48ab44d54410c5e3bd304180d999a68ac10
-
SHA256
80f094059bb6e3b3d59537f1328081ce7782c2a1ea5d1c88956c28a99ea90f55
-
SHA512
12fa7cfc2421633da53bdddf814f8bbab88a3a63394ebe3b5ca4f995e5fec01c3d80bf9fbbb77df029a75ed6ad5b901e2c6bde2e6442dd2f01ce371a97f0e176
-
SSDEEP
1536:dOpa2eted9ykOVFvdboJipvYy4RaP0uvgksgkC3T9u:dOUbted9yzvdbHpvYy4puvbD9u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 80f094059bb6e3b3d59537f1328081ce7782c2a1ea5d1c88956c28a99ea90f55
Files
-
80f094059bb6e3b3d59537f1328081ce7782c2a1ea5d1c88956c28a99ea90f55.dll windows:5 windows x64
f282a49029e1552e7c61d0f09b88a3fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
RtlCompareMemory
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ExAllocatePoolWithTag
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
ExAllocatePool
ZwQueryValueKey
__C_specific_handler
atoi
strstr
_vsnprintf
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
rand
srand
CmUnRegisterCallback
CmRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
PsCreateSystemThread
IoCreateSymbolicLink
RtlUnicodeStringToAnsiString
_vsnwprintf
IoCreateDevice
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
IofCompleteRequest
KeDelayExecutionThread
ObQueryNameString
RtlFreeAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
strlen
RtlInitAnsiString
ExFreePoolWithTag
fltmgr.sys
FltStartFiltering
FltRegisterFilter
Sections
.text Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ