Static task
static1
Behavioral task
behavioral1
Sample
232ddb828a30ff04305ce346e8e0a7f628ded190edfa60a12357ecd9d52158c3.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
232ddb828a30ff04305ce346e8e0a7f628ded190edfa60a12357ecd9d52158c3.dll
Resource
win10v2004-20231023-en
General
-
Target
232ddb828a30ff04305ce346e8e0a7f628ded190edfa60a12357ecd9d52158c3
-
Size
62KB
-
MD5
faf38acc104c2a36a70fa97be996ee17
-
SHA1
afc7c06e80252b2d3b33b495b84d4b70bcb1f49e
-
SHA256
232ddb828a30ff04305ce346e8e0a7f628ded190edfa60a12357ecd9d52158c3
-
SHA512
8d9e8424980a7fc93563062519b27fe376046e8edd11fe5a1d23a87aa4d430069f85393bb03ed2ac728b6a6722e547c6f89234bb4b1ca29826fd8f993913268c
-
SSDEEP
1536:j++9bced9y9HVLwvYMmS6a5Vl6YQDn5y1:j+Cbced9y9dwvYg6a5Viu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 232ddb828a30ff04305ce346e8e0a7f628ded190edfa60a12357ecd9d52158c3
Files
-
232ddb828a30ff04305ce346e8e0a7f628ded190edfa60a12357ecd9d52158c3.dll windows:5 windows x64
0f9ea079ca18d0abab09bfe9b55e157e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
ExFreePoolWithTag
strlen
ExAllocatePool
RtlCompareMemory
KeSetEvent
KeBugCheckEx
IoFreeIrp
KeClearEvent
KeWaitForSingleObject
IoAllocateIrp
IoGetRelatedDeviceObject
KeInitializeEvent
ZwClose
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObfDereferenceObject
ObReferenceObjectByHandle
IoFileObjectType
IoCreateFile
RtlInitUnicodeString
IofCallDriver
NtClose
IoReuseIrp
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlAppendUnicodeToString
ZwSetInformationFile
ZwWriteFile
ObfReferenceObject
ExAllocatePoolWithTag
ZwDeleteFile
wcscat
wcscpy
wcslen
ZwQueryDirectoryFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQueryTimeIncrement
ZwDeleteKey
ZwOpenKey
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwEnumerateKey
ZwQueryKey
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQueryValueKey
__C_specific_handler
atoi
strstr
_vsnprintf
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
MmIsAddressValid
PsGetVersion
MmGetSystemRoutineAddress
CmUnRegisterCallback
RtlCompareUnicodeString
ZwCreateKey
RtlQueryRegistryValues
MmSystemRangeStart
_itoa_s
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
ZwQuerySystemInformation
KeUnstackDetachProcess
ObSetHandleAttributes
PsInitialSystemProcess
IoGetCurrentProcess
KeStackAttachProcess
PsLookupProcessByProcessId
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ