Static task
static1
Behavioral task
behavioral1
Sample
0478d6720b79dca082c1ad99438e8206.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0478d6720b79dca082c1ad99438e8206.dll
Resource
win10v2004-20231215-en
General
-
Target
0478d6720b79dca082c1ad99438e8206
-
Size
36KB
-
MD5
0478d6720b79dca082c1ad99438e8206
-
SHA1
f6b86b8a75b1550c88056be009d756257973437e
-
SHA256
2be041bc2bb24736dc1f319b480f5e020eada770ae54bb5bbb824e311369a08b
-
SHA512
2ecebbd36d392defb7b80dc95e51c8cf9d7f136a4764758a3aa44d15bceab610388d3eca848c6afda2ffc9b8843dfc45a9a31131e3dbad81d27aea9179659b22
-
SSDEEP
768:Ls83rL2zuYq72yjHFrW8CU4NeHVx8WYx:I83f2zuHZS8C1N28bx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0478d6720b79dca082c1ad99438e8206
Files
-
0478d6720b79dca082c1ad99438e8206.dll windows:5 windows x86 arch:x86
9ef33ec4d4730f224a567ff708dd5391
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
ExRaiseStatus
IoRaiseHardError
KeRemoveDeviceQueue
KeInitializeDeviceQueue
IoCheckEaBufferValidity
PsGetProcessExitTime
SeAppendPrivileges
PsGetVersion
IoInitializeIrp
KeRundownQueue
IoInvalidateDeviceState
ExUnregisterCallback
IoGetDeviceInterfaceAlias
FsRtlCheckOplock
KeGetCurrentThread
RtlRandom
IoCreateSynchronizationEvent
RtlUpperString
IoGetAttachedDeviceReference
IoInitializeRemoveLockEx
RtlFindUnicodePrefix
IoGetDiskDeviceObject
ZwClose
IoInvalidateDeviceRelations
ZwQueryValueKey
FsRtlIsFatDbcsLegal
ZwQuerySymbolicLinkObject
IoCancelIrp
KeSetPriorityThread
RtlUpcaseUnicodeChar
IoGetBootDiskInformation
ZwCreateDirectoryObject
MmPageEntireDriver
IoStartPacket
IoAllocateMdl
SeQueryInformationToken
RtlDelete
MmIsDriverVerifying
IoSetDeviceToVerify
CcMdlWriteComplete
KeInitializeDpc
RtlDowncaseUnicodeString
IoSetThreadHardErrorMode
KeSaveFloatingPointState
FsRtlDeregisterUncProvider
IoGetDmaAdapter
IoDeviceObjectType
ZwOpenFile
RtlGetCallersAddress
FsRtlFreeFileLock
MmResetDriverPaging
IoCreateNotificationEvent
RtlAppendStringToString
IoMakeAssociatedIrp
FsRtlMdlWriteCompleteDev
MmAddVerifierThunks
KeResetEvent
ZwOpenSymbolicLinkObject
ExCreateCallback
IoQueryFileDosDeviceName
MmProbeAndLockPages
RtlMultiByteToUnicodeN
KeInitializeTimer
CcPreparePinWrite
ZwNotifyChangeKey
IoGetTopLevelIrp
RtlxOemStringToUnicodeSize
CcFlushCache
ExRaiseAccessViolation
SeValidSecurityDescriptor
ZwCreateFile
RtlCreateAcl
IoGetRequestorProcess
RtlFindNextForwardRunClear
ZwQueryInformationFile
ZwQueryObject
IoAcquireCancelSpinLock
RtlInsertUnicodePrefix
SeOpenObjectAuditAlarm
ExReleaseResourceLite
ZwPowerInformation
SeDeleteObjectAuditAlarm
PsGetProcessId
KeAttachProcess
RtlInitializeBitMap
IoGetStackLimits
IoDisconnectInterrupt
KefAcquireSpinLockAtDpcLevel
IoIsOperationSynchronous
RtlGetVersion
PoCallDriver
IoCsqRemoveIrp
IoDeleteController
ExLocalTimeToSystemTime
ObReleaseObjectSecurity
RtlSetAllBits
KeQueryTimeIncrement
ExDeletePagedLookasideList
IoReleaseVpbSpinLock
IoFreeController
MmFlushImageSection
MmQuerySystemSize
IoCreateSymbolicLink
FsRtlFastCheckLockForRead
ExAllocatePool
FsRtlSplitLargeMcb
KeReleaseMutex
ExGetSharedWaiterCount
CcSetBcbOwnerPointer
ZwOpenProcess
SeQueryAuthenticationIdToken
KeSetImportanceDpc
CcFastCopyWrite
RtlDeleteNoSplay
PsGetCurrentProcessId
PsGetCurrentThread
IoEnumerateDeviceObjectList
ObReferenceObjectByHandle
MmUnmapLockedPages
PsLookupThreadByThreadId
ObfDereferenceObject
ExAllocatePoolWithQuota
MmCanFileBeTruncated
RtlAnsiStringToUnicodeString
RtlCompareMemory
IoGetLowerDeviceObject
MmHighestUserAddress
ExFreePoolWithTag
IoCreateDevice
RtlAppendUnicodeToString
ExGetPreviousMode
ZwQueryKey
ZwLoadDriver
KeReadStateSemaphore
RtlAnsiCharToUnicodeChar
ProbeForWrite
KeSetBasePriorityThread
IoSetTopLevelIrp
ZwFlushKey
ZwFreeVirtualMemory
RtlOemToUnicodeN
IoRequestDeviceEject
MmSecureVirtualMemory
ZwCreateKey
ZwEnumerateValueKey
IoIsWdmVersionAvailable
IoIsSystemThread
IoGetRequestorProcessId
SeAssignSecurity
MmIsAddressValid
RtlPrefixUnicodeString
MmUnlockPages
ExReleaseFastMutexUnsafe
IoThreadToProcess
KeInitializeMutex
SeFreePrivileges
RtlEqualString
CcCopyRead
KeSetKernelStackSwapEnable
IoStartTimer
MmUnsecureVirtualMemory
RtlEqualUnicodeString
PsReferencePrimaryToken
RtlFillMemoryUlong
RtlExtendedIntegerMultiply
RtlGUIDFromString
KeBugCheckEx
IoCheckQuotaBufferValidity
KeInitializeSemaphore
ZwUnloadDriver
IoWriteErrorLogEntry
MmFreeContiguousMemory
KeReadStateEvent
KeEnterCriticalRegion
ZwFsControlFile
RtlWriteRegistryValue
IoFreeIrp
IoGetRelatedDeviceObject
RtlDeleteElementGenericTable
IoQueueWorkItem
IoBuildPartialMdl
RtlCheckRegistryKey
RtlTimeToTimeFields
KeCancelTimer
RtlFreeOemString
FsRtlCheckLockForReadAccess
IoVolumeDeviceToDosName
RtlIsNameLegalDOS8Dot3
KePulseEvent
IoAllocateWorkItem
ExVerifySuite
MmMapLockedPagesSpecifyCache
KeQueryActiveProcessors
RtlCopyUnicodeString
FsRtlFastUnlockSingle
VerSetConditionMask
MmUnmapIoSpace
RtlFindLeastSignificantBit
RtlCopyLuid
KeWaitForSingleObject
IoDeleteSymbolicLink
RtlCreateSecurityDescriptor
RtlTimeFieldsToTime
IoSetShareAccess
SeUnlockSubjectContext
ExDeleteNPagedLookasideList
SeLockSubjectContext
ProbeForRead
CcSetDirtyPinnedData
RtlUnicodeStringToAnsiString
MmProbeAndLockProcessPages
RtlLengthRequiredSid
MmBuildMdlForNonPagedPool
IoSetStartIoAttributes
RtlTimeToSecondsSince1970
MmAllocateContiguousMemory
IoReadDiskSignature
IoConnectInterrupt
MmGetSystemRoutineAddress
RtlRemoveUnicodePrefix
IoAllocateIrp
IoAcquireRemoveLockEx
PsDereferencePrimaryToken
RtlMapGenericMask
IoCreateDisk
RtlSubAuthoritySid
PsReturnPoolQuota
RtlFreeAnsiString
PsSetLoadImageNotifyRoutine
KeSetTargetProcessorDpc
KeQuerySystemTime
RtlInitString
KeInitializeSpinLock
IoDetachDevice
ExIsProcessorFeaturePresent
IoAllocateAdapterChannel
ObQueryNameString
RtlFindClearBitsAndSet
RtlIntegerToUnicodeString
RtlUnicodeStringToInteger
RtlHashUnicodeString
CcInitializeCacheMap
CcSetReadAheadGranularity
CcCopyWrite
CcPinRead
MmFreeMappingAddress
MmFreePagesFromMdl
RtlEnumerateGenericTable
KeInitializeQueue
IoCreateStreamFileObject
FsRtlAllocateFileLock
IoVerifyVolume
RtlFindLongestRunClear
SeCreateClientSecurity
IoWritePartitionTableEx
ExRaiseDatatypeMisalignment
IoGetDeviceInterfaces
FsRtlGetNextFileLock
IoRemoveShareAccess
FsRtlNotifyInitializeSync
KeBugCheck
KeReadStateMutex
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ