Static task
static1
Behavioral task
behavioral1
Sample
0a111971ed3c3ef3c8b9427013ee2eb2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0a111971ed3c3ef3c8b9427013ee2eb2.dll
Resource
win10v2004-20231215-en
General
-
Target
0a111971ed3c3ef3c8b9427013ee2eb2
-
Size
181KB
-
MD5
0a111971ed3c3ef3c8b9427013ee2eb2
-
SHA1
b8ae3492796c412ffd56783999fa5df402726636
-
SHA256
9b2a61fb0f848fe7a479dbf02a47f840cb581ef81f342a73cd55205e5a9e36fb
-
SHA512
29c792260eb774908163a12924079a7505e41c651557199fdd1837440ce2a272cebecda723546b66f945c58878296e8b70501a5cbe4edc495f9c5d38e31e4c8b
-
SSDEEP
3072:FrMuM9VX2XRzIwKaXoOQqb9IcFsN+msn8REcitf0+R3TKEUx41eR:FtM9CMwRQq18REztfDRDEM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a111971ed3c3ef3c8b9427013ee2eb2
Files
-
0a111971ed3c3ef3c8b9427013ee2eb2.dll windows:5 windows x86 arch:x86
150840441fa9624c04e5858601f1e349
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
KeQuerySystemTime
IoQueryFileInformation
RtlFindLeastSignificantBit
IoSetStartIoAttributes
IoGetStackLimits
wcslen
IoReportResourceForDetection
CcUnpinDataForThread
IofCallDriver
FsRtlIsFatDbcsLegal
FsRtlFastUnlockSingle
PoStartNextPowerIrp
RtlAreBitsClear
RtlSplay
SeReleaseSubjectContext
PoCallDriver
IoRegisterFileSystem
RtlUnicodeStringToAnsiString
CcInitializeCacheMap
ZwQuerySymbolicLinkObject
RtlUpperString
ObMakeTemporaryObject
RtlAddAccessAllowedAceEx
KeInsertByKeyDeviceQueue
MmProbeAndLockProcessPages
MmBuildMdlForNonPagedPool
KeRemoveQueueDpc
ObInsertObject
ZwDeleteKey
ExGetSharedWaiterCount
ZwQueryInformationFile
IoCheckShareAccess
IoSetThreadHardErrorMode
RtlSecondsSince1980ToTime
CcUnpinData
Sections
.regfdg Size: 1024B - Virtual size: 1002B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ffgh Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrtr Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uiir Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cfbv Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nmnbm Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ