P:\urCjBnhSHtX\wbEsYEuLIT\ZkzCruCNLhd\lvhfucomGOj\cfruhhnmCu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9b7d14f7719697766c72a1274d0295a7.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9b7d14f7719697766c72a1274d0295a7.dll
Resource
win10v2004-20231222-en
General
-
Target
9b7d14f7719697766c72a1274d0295a7
-
Size
207KB
-
MD5
9b7d14f7719697766c72a1274d0295a7
-
SHA1
0fbb5e6f4ed599d3447367e322332d7c45493da9
-
SHA256
0cdfa1a2e741b969b94309986df155d34c43a06935db4407a8a68191f7135773
-
SHA512
a3107f9c6548a78ff4a1b96308e74d79e12d12717fa5e49765878ef71eb50fc097617ffca02796f5cffc9654bf74e47f4596aba3e8ddca320ac155779e6afa6d
-
SSDEEP
1536:zmuIZLcJBE6iqiAe6+bqpbYkOHWnd9qsMC1gsmIqPjj5wPHMw+CrD7:zFIZkfiqiXuppcsfRmIqP35wRf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b7d14f7719697766c72a1274d0295a7
Files
-
9b7d14f7719697766c72a1274d0295a7.dll windows:5 windows x86 arch:x86
3c501d640c6f4659a5cb55eb635efccc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoInvalidateDeviceState
MmFreeContiguousMemory
KeInitializeApc
IoGetCurrentProcess
RtlTimeToSecondsSince1980
IoConnectInterrupt
IoGetAttachedDevice
CcUnpinRepinnedBcb
RtlSecondsSince1970ToTime
IoVerifyVolume
RtlUpcaseUnicodeString
ProbeForWrite
ZwCreateEvent
KePulseEvent
IoDeviceObjectType
KeSynchronizeExecution
RtlCreateUnicodeString
IoSetSystemPartition
IoRequestDeviceEject
ExAllocatePoolWithQuota
PsSetLoadImageNotifyRoutine
MmAllocatePagesForMdl
IoQueryFileDosDeviceName
IoCreateDevice
KeDeregisterBugCheckCallback
ExRaiseDatatypeMisalignment
SeFreePrivileges
ZwFlushKey
KeGetCurrentThread
SeTokenIsRestricted
MmForceSectionClosed
IoEnumerateDeviceObjectList
ObfDereferenceObject
FsRtlNotifyUninitializeSync
RtlAppendUnicodeToString
IoSetThreadHardErrorMode
IoQueryFileInformation
IoGetBootDiskInformation
RtlUnicodeStringToInteger
RtlIsNameLegalDOS8Dot3
KeDelayExecutionThread
RtlInitUnicodeString
IoThreadToProcess
ZwEnumerateValueKey
CcFastCopyWrite
SeDeleteObjectAuditAlarm
RtlInitializeSid
IoBuildSynchronousFsdRequest
MmFreeMappingAddress
RtlInitializeBitMap
MmFlushImageSection
SeLockSubjectContext
RtlEqualUnicodeString
PsGetCurrentThreadId
RtlQueryRegistryValues
KeRemoveByKeyDeviceQueue
FsRtlGetNextFileLock
KdDisableDebugger
IoSetPartitionInformationEx
PsLookupThreadByThreadId
RtlGUIDFromString
IoAllocateErrorLogEntry
RtlFindClearRuns
CcMdlReadComplete
PsReturnPoolQuota
IoInvalidateDeviceRelations
RtlInt64ToUnicodeString
KeReadStateEvent
RtlFreeAnsiString
RtlUpperChar
RtlFindUnicodePrefix
RtlInsertUnicodePrefix
SeQueryInformationToken
IoSetTopLevelIrp
KeSetSystemAffinityThread
SeAssignSecurity
KeCancelTimer
MmUnlockPagableImageSection
ZwSetVolumeInformationFile
RtlRandom
MmMapLockedPagesSpecifyCache
ExReleaseFastMutexUnsafe
MmFreeNonCachedMemory
ExDeleteNPagedLookasideList
IoDeleteSymbolicLink
PoRegisterSystemState
RtlxAnsiStringToUnicodeSize
MmIsDriverVerifying
ExDeletePagedLookasideList
RtlAddAccessAllowedAceEx
IoQueueWorkItem
KeRevertToUserAffinityThread
RtlMultiByteToUnicodeN
PsRevertToSelf
ZwCreateKey
IoReleaseVpbSpinLock
MmProbeAndLockProcessPages
IoReleaseRemoveLockEx
IoCreateNotificationEvent
RtlCreateSecurityDescriptor
IoReadDiskSignature
IoSetDeviceInterfaceState
KeInsertQueue
RtlxUnicodeStringToAnsiSize
PsLookupProcessByProcessId
RtlCharToInteger
ZwMapViewOfSection
RtlGetCallersAddress
KeQueryActiveProcessors
ExGetExclusiveWaiterCount
IoGetDeviceObjectPointer
RtlCopyLuid
ZwLoadDriver
ObCreateObject
ZwSetSecurityObject
RtlGetVersion
RtlGetNextRange
IoCreateFile
RtlLengthSid
PsGetProcessExitTime
SeReleaseSubjectContext
ExSetTimerResolution
ZwOpenKey
MmIsThisAnNtAsSystem
RtlSetBits
MmIsVerifierEnabled
IoGetDeviceInterfaceAlias
PsImpersonateClient
KeRestoreFloatingPointState
IoCreateDisk
RtlAddAccessAllowedAce
RtlRemoveUnicodePrefix
FsRtlIsDbcsInExpression
CcFlushCache
KeInsertByKeyDeviceQueue
ExSystemTimeToLocalTime
FsRtlDeregisterUncProvider
MmFreePagesFromMdl
PsChargeProcessPoolQuota
KeLeaveCriticalRegion
IoGetLowerDeviceObject
RtlEnumerateGenericTable
KeReleaseMutex
IoAllocateWorkItem
IoGetDiskDeviceObject
RtlInitString
KeSetImportanceDpc
ExRegisterCallback
IoUpdateShareAccess
SePrivilegeCheck
ExFreePoolWithTag
IoReportDetectedDevice
ZwCreateSection
MmUnmapReservedMapping
RtlAnsiCharToUnicodeChar
MmHighestUserAddress
MmAllocateMappingAddress
MmBuildMdlForNonPagedPool
ZwQueryKey
CcRepinBcb
IoRemoveShareAccess
KeInitializeDpc
IoAcquireRemoveLockEx
ZwDeleteValueKey
ZwEnumerateKey
SeSetSecurityDescriptorInfo
RtlAreBitsSet
IoOpenDeviceRegistryKey
ZwOpenFile
RtlSetAllBits
MmLockPagableDataSection
KeAttachProcess
RtlDeleteElementGenericTable
IoIsOperationSynchronous
KeQuerySystemTime
IoQueryDeviceDescription
PoRequestPowerIrp
ExAllocatePoolWithTag
IoCheckQuotaBufferValidity
RtlInitAnsiString
CcFastMdlReadWait
RtlUpperString
CcSetReadAheadGranularity
IoVerifyPartitionTable
KeWaitForMultipleObjects
MmAllocateContiguousMemory
IofCallDriver
ExRaiseStatus
MmSecureVirtualMemory
ExQueueWorkItem
RtlClearAllBits
FsRtlFastUnlockSingle
KefAcquireSpinLockAtDpcLevel
IoDeleteDevice
CcUnpinDataForThread
CcMdlWriteComplete
KeRundownQueue
RtlUnicodeStringToAnsiString
RtlTimeToSecondsSince1970
KeQueryTimeIncrement
ZwFreeVirtualMemory
SeFilterToken
FsRtlCheckOplock
RtlUpcaseUnicodeToOemN
KeInitializeEvent
FsRtlLookupLastLargeMcbEntry
PoCallDriver
KeSetTargetProcessorDpc
IoFreeMdl
KeInsertHeadQueue
SeValidSecurityDescriptor
MmProbeAndLockPages
IoWriteErrorLogEntry
CcInitializeCacheMap
IoStartNextPacket
PsTerminateSystemThread
IoReleaseRemoveLockAndWaitEx
ObMakeTemporaryObject
KeStackAttachProcess
CcFastCopyRead
MmMapIoSpace
SeDeassignSecurity
MmPageEntireDriver
FsRtlFastCheckLockForRead
PoUnregisterSystemState
IoGetRelatedDeviceObject
SeQueryAuthenticationIdToken
CcMdlRead
RtlTimeToTimeFields
KeSetPriorityThread
CcPreparePinWrite
DbgPrompt
FsRtlNotifyInitializeSync
IoInitializeRemoveLockEx
IoStopTimer
MmAdvanceMdl
IoAllocateAdapterChannel
CcPurgeCacheSection
KeWaitForSingleObject
RtlClearBits
ExReleaseResourceLite
IoGetRequestorProcess
RtlAnsiStringToUnicodeString
PsCreateSystemThread
IoGetRequestorProcessId
KeDetachProcess
KeRegisterBugCheckCallback
VerSetConditionMask
CcMdlWriteAbort
RtlFindClearBitsAndSet
MmUnsecureVirtualMemory
IoAllocateIrp
IoVolumeDeviceToDosName
ExAllocatePoolWithQuotaTag
IoFreeErrorLogEntry
ZwQueryValueKey
PsDereferencePrimaryToken
IofCompleteRequest
ProbeForRead
Exports
Exports
?FreeProcess@@IJPAKPAN@X
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ