J:\hxnlFzquEwOf\zqtSzgmn\FdjGPGC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8f19d5a9e85edf8da88bbe4281964f2c.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8f19d5a9e85edf8da88bbe4281964f2c.dll
Resource
win10v2004-20231215-en
General
-
Target
8f19d5a9e85edf8da88bbe4281964f2c
-
Size
134KB
-
MD5
8f19d5a9e85edf8da88bbe4281964f2c
-
SHA1
768f2e85f79f5f62e533f1df3d89b8a2775b531c
-
SHA256
e53fab88fc3108445abadbe5350237959543e37cd5199ce3e62b7e2c48efc4ff
-
SHA512
65610dff1a6123e4db88fb58d9cd9dd77544dfa54c5b8914deaa95856cc82bc8a29c09e15afe95fec3a3fe5b6c0aa92c83f09248b448682fba164842aa611e10
-
SSDEEP
3072:E1Aub0bJB9ORtW5IW7Odrg0jvX7H5LIyA40ESxgx:EDMORt2IW7O5gA7Hh10ETx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8f19d5a9e85edf8da88bbe4281964f2c
Files
-
8f19d5a9e85edf8da88bbe4281964f2c.dll windows:5 windows x86 arch:x86
6ddbbf336a6132f236f7579bc562748e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlCreateAcl
CcMapData
ZwQueryKey
MmGetPhysicalAddress
ExGetExclusiveWaiterCount
ExSetTimerResolution
ExDeletePagedLookasideList
KeRegisterBugCheckCallback
RtlCreateRegistryKey
FsRtlFreeFileLock
SeDeassignSecurity
RtlSetDaclSecurityDescriptor
KeReadStateMutex
ZwSetSecurityObject
ZwWriteFile
RtlFindSetBits
IoIsWdmVersionAvailable
ExUuidCreate
ZwCreateEvent
MmUnmapIoSpace
RtlVerifyVersionInfo
IoRequestDeviceEject
RtlUpcaseUnicodeChar
ObQueryNameString
RtlFindClearRuns
ExLocalTimeToSystemTime
PoCallDriver
PoRegisterSystemState
RtlUnicodeStringToInteger
SeSetSecurityDescriptorInfo
RtlCopyLuid
ZwMapViewOfSection
ZwSetValueKey
CcUnpinData
RtlInitializeBitMap
IoSetPartitionInformation
KeDetachProcess
IoDisconnectInterrupt
PsGetCurrentProcess
RtlRemoveUnicodePrefix
MmIsThisAnNtAsSystem
RtlUpcaseUnicodeToOemN
IoGetDeviceInterfaceAlias
CcIsThereDirtyData
RtlxOemStringToUnicodeSize
ZwQueryInformationFile
IoRemoveShareAccess
IoFreeIrp
RtlCheckRegistryKey
MmAllocateMappingAddress
RtlMapGenericMask
CcMdlWriteAbort
ExUnregisterCallback
KeResetEvent
KeRemoveQueue
ExReleaseResourceLite
RtlValidSecurityDescriptor
RtlOemStringToUnicodeString
SeAppendPrivileges
KeQueryInterruptTime
IoWMIRegistrationControl
CcMdlWriteComplete
FsRtlCheckOplock
RtlCompareMemory
KeSetImportanceDpc
RtlLengthRequiredSid
KdDisableDebugger
ZwEnumerateKey
CcUninitializeCacheMap
CcFastMdlReadWait
KeInitializeDeviceQueue
RtlRandom
MmFreeContiguousMemory
PsGetCurrentThread
RtlIsNameLegalDOS8Dot3
FsRtlDeregisterUncProvider
IoStopTimer
IoSetHardErrorOrVerifyDevice
ZwOpenSection
MmSecureVirtualMemory
KeSetTimer
MmProbeAndLockProcessPages
ObReferenceObjectByHandle
IoConnectInterrupt
CcFastCopyRead
MmAllocatePagesForMdl
FsRtlSplitLargeMcb
IoUpdateShareAccess
RtlGetVersion
KeInsertQueueDpc
RtlAnsiStringToUnicodeString
PsGetProcessId
RtlValidSid
KeCancelTimer
RtlFindMostSignificantBit
ZwReadFile
SeOpenObjectAuditAlarm
KdEnableDebugger
IoFreeMdl
IoReuseIrp
RtlGetNextRange
IoDeleteSymbolicLink
ZwCreateKey
CcPinRead
SeAssignSecurity
IoGetAttachedDeviceReference
IoVerifyPartitionTable
IoQueueWorkItem
PsCreateSystemThread
ProbeForWrite
PoStartNextPowerIrp
RtlFillMemoryUlong
MmUnsecureVirtualMemory
SeFreePrivileges
IoInitializeTimer
RtlEqualUnicodeString
CcUnpinRepinnedBcb
MmResetDriverPaging
KeInsertDeviceQueue
RtlCompareString
PsChargeProcessPoolQuota
RtlAddAccessAllowedAce
ExDeleteResourceLite
MmUnmapLockedPages
ZwPowerInformation
RtlAreBitsClear
MmIsDriverVerifying
IoOpenDeviceRegistryKey
PoSetPowerState
RtlInitAnsiString
SeCaptureSubjectContext
CcFlushCache
MmCanFileBeTruncated
CcZeroData
IoAcquireRemoveLockEx
RtlInitString
IoThreadToProcess
FsRtlCheckLockForReadAccess
MmFreeMappingAddress
CcSetFileSizes
KeReleaseSemaphore
ExSetResourceOwnerPointer
RtlSetAllBits
CcPreparePinWrite
RtlTimeToSecondsSince1980
MmFreePagesFromMdl
MmMapLockedPages
KeBugCheckEx
ExGetSharedWaiterCount
RtlxAnsiStringToUnicodeSize
RtlInitializeUnicodePrefix
IoAcquireVpbSpinLock
IoAllocateAdapterChannel
RtlInitializeSid
RtlAnsiCharToUnicodeChar
KeRestoreFloatingPointState
MmAllocateNonCachedMemory
ExAllocatePoolWithQuotaTag
IoReadPartitionTable
RtlSplay
CcPinMappedData
IoGetLowerDeviceObject
PsGetProcessExitTime
FsRtlMdlWriteCompleteDev
KeReadStateTimer
KeInsertHeadQueue
IoStartPacket
IoCancelIrp
KeFlushQueuedDpcs
RtlGUIDFromString
SeTokenIsRestricted
MmUnlockPagableImageSection
RtlGenerate8dot3Name
KeRevertToUserAffinityThread
RtlFindLastBackwardRunClear
FsRtlNotifyUninitializeSync
IoCheckEaBufferValidity
RtlFindUnicodePrefix
KeGetCurrentThread
IoCreateNotificationEvent
RtlUnicodeStringToOemString
RtlAppendStringToString
RtlEnumerateGenericTable
IoAllocateMdl
RtlTimeToSecondsSince1970
IoReleaseCancelSpinLock
KeInitializeTimer
IoWMIWriteEvent
MmMapLockedPagesSpecifyCache
IoSetStartIoAttributes
RtlFreeOemString
RtlSecondsSince1970ToTime
FsRtlIsFatDbcsLegal
IoReadDiskSignature
IoFreeWorkItem
KeSetTimerEx
HalExamineMBR
IoAllocateController
RtlInitializeGenericTable
KeInsertQueue
IoRegisterDeviceInterface
RtlAddAccessAllowedAceEx
IoGetDmaAdapter
FsRtlIsDbcsInExpression
IoCreateStreamFileObjectLite
ExQueueWorkItem
FsRtlCheckLockForWriteAccess
IoInvalidateDeviceRelations
KeUnstackDetachProcess
CcGetFileObjectFromBcb
RtlClearAllBits
CcMdlReadComplete
RtlDelete
RtlCopyString
KeDeregisterBugCheckCallback
KeReleaseMutex
RtlFindLongestRunClear
FsRtlAllocateFileLock
KeSetSystemAffinityThread
MmFreeNonCachedMemory
RtlNtStatusToDosError
RtlExtendedIntegerMultiply
IofCallDriver
ZwNotifyChangeKey
RtlNumberOfClearBits
IoQueryDeviceDescription
RtlUnicodeToMultiByteN
ZwQueryVolumeInformationFile
FsRtlNotifyInitializeSync
RtlEqualSid
SeFilterToken
IoQueryFileDosDeviceName
DbgBreakPointWithStatus
ZwQueryObject
RtlDeleteRegistryValue
RtlFreeAnsiString
IoCreateStreamFileObject
KeSetEvent
IoBuildSynchronousFsdRequest
IoAllocateIrp
FsRtlLookupLastLargeMcbEntry
DbgPrompt
IoWritePartitionTableEx
MmIsVerifierEnabled
IoStartNextPacket
MmUnmapReservedMapping
KeReadStateSemaphore
MmGetSystemRoutineAddress
KeInitializeDpc
ExReinitializeResourceLite
ObfDereferenceObject
IoGetDriverObjectExtension
RtlCompareUnicodeString
KeStackAttachProcess
RtlDeleteElementGenericTable
IoGetDeviceObjectPointer
FsRtlIsNameInExpression
RtlCreateUnicodeString
ExAllocatePoolWithQuota
ZwCreateDirectoryObject
Exports
Exports
?CrtEventExW@@YGXEPAFPAK~U
?GetDeviceEx@@YGPAIFDD~U
?ValidateProfileOld@@YGXH~U
?GenerateCharExW@@YGKIDPAI~U
?ModifyScreenOriginal@@YGDJ~U
?IncrementProfileOld@@YGMK~U
?CloseOption@@YGJPAHPADHJ~U
?EnumTime@@YGMPA_NPAH~U
?DeleteFilePath@@YGXPAFF~U
?InsertStateA@@YG_NIK~U
?CrtHeightA@@YGXEPAM~U
?SendName@@YGFPAKPAIPAM~U
?LoadFilePath@@YGIPAF~U
?ShowListItemOriginal@@YGPAJ_N~U
?InvalidateConfigOld@@YGPAMIKM~U
?CloseMutantOld@@YGPAGPAFPAH~U
?RemoveAnchorEx@@YGPAJE_NNPAK~U
?GlobalScreenNew@@YGGPAGPAKG~U
?OnHeaderExA@@YGGD~U
?IsValidSemaphoreExA@@YGHPAKPAE~U
?IsValidComponent@@YGEEPAMKK~U
?CopyVersionExW@@YGJPAIE~U
?CancelSemaphoreA@@YGJPAJEPADE~U
?FindMessageExA@@YGPAHE~U
?FindMutexExW@@YGPAIGPA_NE~U
?IsTextA@@YGGH_NNPAK~U
?EnumSemaphoreExW@@YGPAIPAM~U
?RtlNameA@@YGIKHH~U
?GenerateFolderExA@@YGIPANI~U
?IsValidMemoryA@@YGIKPAIKK~U
?EnumScreenEx@@YGEKJF~U
?RemoveMessageExA@@YGD_NPAHJ~U
?KillProviderOld@@YGPAIKK~U
Sections
.text Size: 29KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ