W:\zbWqmzvd\qvYawpdA\siMvlqonzjJ\QYmCcqgabg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bc70a24fb14d1f7a340386754b265fe6.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bc70a24fb14d1f7a340386754b265fe6.dll
Resource
win10v2004-20240226-en
General
-
Target
bc70a24fb14d1f7a340386754b265fe6
-
Size
135KB
-
MD5
bc70a24fb14d1f7a340386754b265fe6
-
SHA1
6cc057535e1f8917af405cd6c92474b1962a7911
-
SHA256
9253d355812873b704c0825e8e4af9e7e72f4ae287a6b12c1d25af0c50bace27
-
SHA512
5fdfaf50c31b1fdc1609163cc17b86b608a88fe0566846129e4f3b4d75fa57040de1464e8c136817d9ff055ce4293c15b9654b58fe4be179e0c31631c0d69077
-
SSDEEP
3072:5Gz6GIdIxUArc7A0FvlyHvKkXmSC+KvgguJ:EOVAFAyHyVSFKvgJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc70a24fb14d1f7a340386754b265fe6
Files
-
bc70a24fb14d1f7a340386754b265fe6.dll windows:5 windows x86 arch:x86
571bbdf4ca96e8d4781efba9d5ad7910
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlAddAccessAllowedAceEx
RtlxAnsiStringToUnicodeSize
ZwMapViewOfSection
IoSetSystemPartition
IoRaiseHardError
RtlEqualUnicodeString
KeSetTargetProcessorDpc
KeSetBasePriorityThread
KeInsertByKeyDeviceQueue
ZwOpenSymbolicLinkObject
IoWriteErrorLogEntry
IoVolumeDeviceToDosName
RtlAreBitsSet
RtlUpperString
MmCanFileBeTruncated
RtlCopyLuid
RtlGetNextRange
KeCancelTimer
IoRegisterDeviceInterface
CcCopyWrite
IoGetCurrentProcess
RtlInitializeBitMap
PoCallDriver
ZwSetVolumeInformationFile
SeAppendPrivileges
IoThreadToProcess
IoGetStackLimits
ExSetTimerResolution
RtlFindUnicodePrefix
ExVerifySuite
MmUnmapReservedMapping
KeSetPriorityThread
RtlAnsiCharToUnicodeChar
ExDeletePagedLookasideList
PsGetCurrentProcessId
ObfReferenceObject
ExIsProcessorFeaturePresent
MmIsDriverVerifying
PoRegisterSystemState
RtlInitUnicodeString
DbgBreakPoint
CcCopyRead
PsLookupThreadByThreadId
VerSetConditionMask
RtlFreeOemString
IoSetHardErrorOrVerifyDevice
RtlGetCallersAddress
RtlRandom
HalExamineMBR
ObInsertObject
MmUnlockPages
KeSetEvent
RtlInitializeGenericTable
IoStopTimer
KeReadStateSemaphore
SeLockSubjectContext
RtlInitAnsiString
RtlInsertUnicodePrefix
RtlIntegerToUnicodeString
ExQueueWorkItem
RtlWriteRegistryValue
RtlValidSecurityDescriptor
KeSaveFloatingPointState
KeQueryTimeIncrement
ZwDeleteKey
KeDetachProcess
RtlCopySid
RtlOemToUnicodeN
IoQueueWorkItem
CcGetFileObjectFromBcb
ZwCreateSection
MmMapLockedPagesSpecifyCache
SeOpenObjectAuditAlarm
KeRemoveQueueDpc
ZwQueryObject
RtlFindMostSignificantBit
PsLookupProcessByProcessId
CcSetFileSizes
MmSecureVirtualMemory
ExAcquireResourceSharedLite
MmAdvanceMdl
MmMapIoSpace
MmUnsecureVirtualMemory
ZwOpenKey
RtlAnsiStringToUnicodeString
PsImpersonateClient
ExRaiseAccessViolation
IoAllocateErrorLogEntry
RtlPrefixUnicodeString
RtlSecondsSince1980ToTime
MmAllocateNonCachedMemory
ZwClose
IoCreateSymbolicLink
IoGetAttachedDeviceReference
RtlUpcaseUnicodeString
IoInitializeTimer
IoGetLowerDeviceObject
SeDeassignSecurity
ZwEnumerateValueKey
ExLocalTimeToSystemTime
RtlOemStringToUnicodeString
PsGetCurrentProcess
ObOpenObjectByPointer
FsRtlIsFatDbcsLegal
KeDelayExecutionThread
IoWritePartitionTableEx
RtlEqualSid
ExAcquireFastMutexUnsafe
PsCreateSystemThread
MmUnmapIoSpace
FsRtlIsDbcsInExpression
ExSystemTimeToLocalTime
IoCreateFile
MmFreeMappingAddress
FsRtlGetNextFileLock
KeInitializeDpc
MmLockPagableDataSection
SeAssignSecurity
IoAllocateAdapterChannel
RtlCharToInteger
KeSetSystemAffinityThread
RtlFindNextForwardRunClear
IoVerifyVolume
CcUnpinRepinnedBcb
ZwMakeTemporaryObject
KdDisableDebugger
RtlTimeToSecondsSince1970
IoIsWdmVersionAvailable
CcMdlWriteComplete
SeReleaseSubjectContext
ExGetSharedWaiterCount
CcFastMdlReadWait
SeSetSecurityDescriptorInfo
RtlAddAccessAllowedAce
KeRundownQueue
ExAllocatePoolWithQuota
RtlGUIDFromString
MmFreeNonCachedMemory
ZwCreateKey
RtlFindLongestRunClear
IoBuildSynchronousFsdRequest
RtlCopyString
CcInitializeCacheMap
MmGetSystemRoutineAddress
FsRtlAllocateFileLock
RtlCheckRegistryKey
KeReleaseSemaphore
IoAllocateIrp
RtlCompareUnicodeString
RtlIsNameLegalDOS8Dot3
KeInitializeApc
IoInitializeRemoveLockEx
IoDeleteSymbolicLink
CcFastCopyRead
IoStartPacket
IoRequestDeviceEject
IoFreeWorkItem
SeQueryAuthenticationIdToken
CcZeroData
RtlCompareMemory
KeInitializeQueue
ZwFreeVirtualMemory
IoAcquireRemoveLockEx
MmProbeAndLockPages
IoReportDetectedDevice
IoReleaseRemoveLockAndWaitEx
IoReadPartitionTable
CcMdlReadComplete
MmIsVerifierEnabled
SeValidSecurityDescriptor
IoSetThreadHardErrorMode
MmIsAddressValid
MmUnmapLockedPages
IoWMIRegistrationControl
PsChargeProcessPoolQuota
KeSetTimer
KePulseEvent
ExGetPreviousMode
IoCreateStreamFileObject
RtlTimeToSecondsSince1980
RtlUnicodeStringToOemString
RtlLengthSid
IoGetTopLevelIrp
ExReinitializeResourceLite
IoSetShareAccess
IoCreateNotificationEvent
RtlAppendStringToString
CcSetDirtyPinnedData
IoFreeController
ZwLoadDriver
ObReleaseObjectSecurity
CcFastCopyWrite
RtlMapGenericMask
KeSynchronizeExecution
IoInvalidateDeviceRelations
IoRemoveShareAccess
IoCreateDevice
IoCreateStreamFileObjectLite
FsRtlFastUnlockSingle
KeWaitForMultipleObjects
KeQuerySystemTime
ExSetResourceOwnerPointer
IoBuildPartialMdl
CcPreparePinWrite
RtlVolumeDeviceToDosName
KeFlushQueuedDpcs
ZwSetValueKey
KeGetCurrentThread
CcMdlWriteAbort
CcRemapBcb
FsRtlCheckLockForReadAccess
IofCallDriver
PsGetThreadProcessId
KeReadStateTimer
RtlCreateUnicodeString
IoInitializeIrp
RtlFreeUnicodeString
KeEnterCriticalRegion
IoAcquireVpbSpinLock
IoSetTopLevelIrp
RtlFindClearRuns
ExInitializeResourceLite
MmHighestUserAddress
RtlUpperChar
ZwOpenSection
RtlInitializeUnicodePrefix
IoDeviceObjectType
KeInitializeMutex
DbgPrompt
IoVerifyPartitionTable
ZwQueryVolumeInformationFile
IoInvalidateDeviceState
CcPurgeCacheSection
MmAddVerifierThunks
CcUnpinDataForThread
IoFreeErrorLogEntry
RtlInt64ToUnicodeString
PoRequestPowerIrp
RtlCompareString
FsRtlFreeFileLock
RtlUpcaseUnicodeToOemN
ExAllocatePool
IoGetDiskDeviceObject
KeInitializeTimer
ProbeForWrite
IoAcquireCancelSpinLock
ZwQuerySymbolicLinkObject
IoGetRequestorProcess
WmiQueryTraceInformation
SeFreePrivileges
KeRegisterBugCheckCallback
MmForceSectionClosed
FsRtlMdlWriteCompleteDev
IoCheckShareAccess
FsRtlDeregisterUncProvider
IoGetDeviceInterfaceAlias
RtlCreateAcl
MmSetAddressRangeModified
MmFreeContiguousMemory
ZwCreateEvent
IoWMIWriteEvent
IoCreateSynchronizationEvent
IoGetDeviceToVerify
Sections
.text Size: 25KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 698B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ