M:\ZcdSntkKsLjfo\qhmyjfdBUmjK\zKRtruKqpu\yDtvpvOFULxf\pgWlqvqvJd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b652a880f45f7d3aa5e36d77ed29fe35.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b652a880f45f7d3aa5e36d77ed29fe35.dll
Resource
win10v2004-20240226-en
General
-
Target
b652a880f45f7d3aa5e36d77ed29fe35
-
Size
106KB
-
MD5
b652a880f45f7d3aa5e36d77ed29fe35
-
SHA1
fb153f87c9bf76f80489f42c3628f90b97cd0270
-
SHA256
15a7027a719b57ec44b22e1f5f81c4ab44c81f7166b596b18548820f1c82f33f
-
SHA512
961fd7a376ff98d5c099a636bc608c3f8bcaacceece5a287aca0c0fa2e2a8edb0f87bcd4b9e5d73c8debe1a5bb22bf5acb7da9e9027d6d14d428ec6e300c5b20
-
SSDEEP
1536:EMucPmxQIxTMgX4feLJns3JGem1ikJPwJSyQayjaiy:EYo9LX4feNsWvpUSXjaD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b652a880f45f7d3aa5e36d77ed29fe35
Files
-
b652a880f45f7d3aa5e36d77ed29fe35.dll windows:5 windows x86 arch:x86
925b4de23ecba2cfaa406b501adee8d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoWriteErrorLogEntry
IoRequestDeviceEject
PsGetCurrentThreadId
CcRemapBcb
RtlTimeToSecondsSince1980
RtlFindLastBackwardRunClear
CcFastMdlReadWait
ZwDeviceIoControlFile
IoStartTimer
ObfReferenceObject
KeRemoveByKeyDeviceQueue
MmAllocateMappingAddress
ZwFreeVirtualMemory
IoIsWdmVersionAvailable
MmAllocateNonCachedMemory
MmCanFileBeTruncated
SeTokenIsAdmin
FsRtlCheckLockForWriteAccess
RtlFreeUnicodeString
KeCancelTimer
ExAllocatePoolWithQuota
IoWMIRegistrationControl
PsDereferencePrimaryToken
KeSynchronizeExecution
RtlDelete
CcPreparePinWrite
RtlInsertUnicodePrefix
ZwOpenKey
ZwCreateDirectoryObject
ExRaiseDatatypeMisalignment
FsRtlFreeFileLock
ZwMakeTemporaryObject
ObReferenceObjectByPointer
PsImpersonateClient
MmSizeOfMdl
PsIsThreadTerminating
IoSetSystemPartition
RtlxAnsiStringToUnicodeSize
ZwOpenFile
KeInitializeTimerEx
RtlInitString
CcMdlRead
RtlMultiByteToUnicodeN
PoUnregisterSystemState
IoCreateSynchronizationEvent
RtlExtendedIntegerMultiply
MmUnmapIoSpace
IoCreateFile
IoConnectInterrupt
MmUnsecureVirtualMemory
KeSetSystemAffinityThread
IoRegisterDeviceInterface
KdDisableDebugger
MmIsDriverVerifying
RtlLengthSecurityDescriptor
CcCopyWrite
IoReleaseRemoveLockAndWaitEx
IoAllocateErrorLogEntry
CcCanIWrite
IoAllocateController
IoFreeErrorLogEntry
CcFlushCache
IoRaiseHardError
KeReadStateSemaphore
IoSetDeviceInterfaceState
KeSetImportanceDpc
MmSetAddressRangeModified
IoIsOperationSynchronous
RtlTimeToSecondsSince1970
ZwEnumerateValueKey
RtlAreBitsSet
RtlRandom
FsRtlIsHpfsDbcsLegal
ObfDereferenceObject
KeDetachProcess
RtlFindClearRuns
CcUnpinDataForThread
CcPurgeCacheSection
ZwMapViewOfSection
IoSetPartitionInformation
SeCreateClientSecurity
ExSystemTimeToLocalTime
ZwOpenProcess
IoDeviceObjectType
KeQuerySystemTime
IoRemoveShareAccess
KeLeaveCriticalRegion
FsRtlNotifyUninitializeSync
ObReferenceObjectByHandle
FsRtlDeregisterUncProvider
IoIsSystemThread
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
KeSetKernelStackSwapEnable
RtlRemoveUnicodePrefix
RtlEqualString
CcSetReadAheadGranularity
RtlUnicodeStringToOemString
ZwAllocateVirtualMemory
SeSetSecurityDescriptorInfo
IoInvalidateDeviceState
RtlInitializeSid
KeDeregisterBugCheckCallback
RtlInitAnsiString
ZwUnloadDriver
ExIsProcessorFeaturePresent
SeTokenIsRestricted
ZwDeleteValueKey
PsLookupThreadByThreadId
KdEnableDebugger
SeImpersonateClientEx
PoRequestPowerIrp
IoVerifyPartitionTable
HalExamineMBR
RtlUnicodeToOemN
KeStackAttachProcess
RtlGetCallersAddress
KeAttachProcess
RtlFindMostSignificantBit
IoUnregisterFileSystem
KeInitializeSpinLock
KeInitializeEvent
FsRtlFastCheckLockForRead
IoInvalidateDeviceRelations
RtlCopySid
IoDetachDevice
ExAllocatePoolWithTag
RtlDeleteNoSplay
FsRtlSplitLargeMcb
SeQueryInformationToken
IoCheckEaBufferValidity
PsGetCurrentThread
KeInitializeApc
IoGetRequestorProcessId
KeWaitForMultipleObjects
RtlGetNextRange
KeRemoveEntryDeviceQueue
IoFreeWorkItem
RtlUnicodeStringToInteger
KeQueryActiveProcessors
KeReleaseMutex
SeFreePrivileges
MmMapIoSpace
FsRtlIsTotalDeviceFailure
RtlPrefixUnicodeString
IoCreateStreamFileObjectLite
KeBugCheck
IoOpenDeviceRegistryKey
KeResetEvent
IoGetDeviceToVerify
MmBuildMdlForNonPagedPool
IoGetLowerDeviceObject
ZwEnumerateKey
ExGetExclusiveWaiterCount
IoDeleteDevice
FsRtlCheckLockForReadAccess
CcFastCopyWrite
KeInitializeSemaphore
PsTerminateSystemThread
FsRtlMdlWriteCompleteDev
IoAllocateMdl
IoAcquireVpbSpinLock
CcFastCopyRead
IoSetDeviceToVerify
RtlUnicodeToMultiByteN
IoGetDeviceProperty
RtlFillMemoryUlong
MmGetPhysicalAddress
CcGetFileObjectFromBcb
ZwSetVolumeInformationFile
RtlValidSid
ZwClose
RtlAnsiCharToUnicodeChar
PoStartNextPowerIrp
SeQueryAuthenticationIdToken
RtlAddAccessAllowedAce
KeReleaseSemaphore
ExDeletePagedLookasideList
ZwQueryKey
IoReportDetectedDevice
IoDeleteSymbolicLink
CcZeroData
DbgBreakPointWithStatus
IoGetDriverObjectExtension
MmProbeAndLockProcessPages
MmMapUserAddressesToPage
KeInitializeQueue
PoSetSystemState
KeClearEvent
IoCheckShareAccess
RtlAddAccessAllowedAceEx
MmUnmapReservedMapping
CcMdlWriteAbort
PsReturnPoolQuota
RtlTimeToTimeFields
IoSetTopLevelIrp
CcCopyRead
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeSaveFloatingPointState
MmResetDriverPaging
SeSinglePrivilegeCheck
IofCompleteRequest
RtlxOemStringToUnicodeSize
MmUnmapLockedPages
SeCaptureSubjectContext
ExGetPreviousMode
RtlCreateSecurityDescriptor
RtlCreateUnicodeString
MmAllocateContiguousMemory
ExDeleteResourceLite
KeInsertByKeyDeviceQueue
IoAllocateIrp
IoCreateDevice
MmFreePagesFromMdl
RtlAppendStringToString
PsGetProcessId
MmUnlockPages
MmUnlockPagableImageSection
IoCreateSymbolicLink
IoGetAttachedDevice
KeSetPriorityThread
MmGetSystemRoutineAddress
ObCreateObject
KePulseEvent
RtlUpcaseUnicodeString
IoGetTopLevelIrp
KeRestoreFloatingPointState
MmFreeMappingAddress
SeOpenObjectAuditAlarm
FsRtlIsNameInExpression
IoSetPartitionInformationEx
IoStartPacket
KeQueryTimeIncrement
RtlSetBits
MmHighestUserAddress
MmIsVerifierEnabled
ObReleaseObjectSecurity
KeRemoveQueue
IoFreeMdl
ZwCreateKey
ZwSetValueKey
RtlFindClearBits
ExSetResourceOwnerPointer
IoGetRequestorProcess
SeFilterToken
KeInsertHeadQueue
FsRtlGetNextFileLock
RtlClearBits
KeBugCheckEx
RtlFindNextForwardRunClear
SeReleaseSubjectContext
ExGetSharedWaiterCount
SeAccessCheck
CcUnpinData
Exports
Exports
?CancelTimeNew@@IJGI@X
?MediaTypeA@@IJPAXPAJG@X
?DecrementProcessOld@@IJMPAH@X
?OnAnchorOld@@IJNJJ@X
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ