Static task
static1
Behavioral task
behavioral1
Sample
338d89923436688382abaef3c9c3a2bb.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
338d89923436688382abaef3c9c3a2bb.dll
Resource
win10v2004-20231215-en
General
-
Target
338d89923436688382abaef3c9c3a2bb
-
Size
229KB
-
MD5
338d89923436688382abaef3c9c3a2bb
-
SHA1
dabc12dc3b26db46d776e9ec30e2e524a45b0c01
-
SHA256
15db65cae3b971547ff26cb5565c62166489430d11a1b098df11170b5c827290
-
SHA512
069775e982e26039d1e141c029220471450dcc4684a08fe5481e6f88bad0e955f8422279baf16db0db3f22b0648d29e8add4dd0fd47a42163dadb4e77083e80b
-
SSDEEP
3072:y5inno8Y7hkkfbQ9jTWaDnOjIiMYiaPiFqvxyCkuEotGTK0I8iKEXGQ//ZgxfTBD:U88QVW6QC/qvuuvtsTN0/OfTBtY2qPI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 338d89923436688382abaef3c9c3a2bb
Files
-
338d89923436688382abaef3c9c3a2bb.dll windows:5 windows x86 arch:x86
25c5dc3f8d85df67a5d77ec29e6379e1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
IoAcquireRemoveLockEx
FsRtlIsNameInExpression
SeCaptureSubjectContext
RtlDelete
MmUnsecureVirtualMemory
IoReadDiskSignature
ZwReadFile
RtlGenerate8dot3Name
ExIsProcessorFeaturePresent
wcslen
CcMdlWriteAbort
IoFreeController
KdDisableDebugger
SeFreePrivileges
RtlRandom
ObReferenceObjectByPointer
CcMdlRead
ExRegisterCallback
IoWritePartitionTableEx
ZwOpenProcess
KeSetEvent
IoGetStackLimits
IoGetAttachedDeviceReference
IoGetRequestorProcessId
RtlUnicodeStringToOemString
ZwQueryKey
RtlUpcaseUnicodeChar
IoConnectInterrupt
RtlInitializeUnicodePrefix
RtlValidSecurityDescriptor
ZwQueryObject
RtlxOemStringToUnicodeSize
IoCheckEaBufferValidity
ZwQuerySymbolicLinkObject
WmiQueryTraceInformation
ExAllocatePoolWithTag
Sections
.fgghg Size: 1024B - Virtual size: 820B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uytu Size: 1024B - Virtual size: 1006B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmem Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ