be06f58ad84fc6a2f416b0f3d0902689

Sharing

Copy URL

Twitter E-mail

General

Target

be06f58ad84fc6a2f416b0f3d0902689
Size

140KB
MD5

be06f58ad84fc6a2f416b0f3d0902689
SHA1

7269c1a22246e5671b5b32a4a50ee957ea8be64d
SHA256

ecfae637f6dbcd3fde022536305abe0680a52d14f2abdfb6b30153d4520c4588
SHA512

b33f696c372f8c7d665e792f040292dca51e2e72b79c262d0f460c0bb7af1227c9c439a0af7559b938a43d4ddb3b0ec3fba1266a0a5bc06575437e7f003f6a2d
SSDEEP

1536:Z5gNoPt7k+drfbfhwtnOo0mpHQfFUVe8jW9acY65cCiCSDH:ZwWiKz5wt1QNUVe8jR/65cHb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be06f58ad84fc6a2f416b0f3d0902689

Files

be06f58ad84fc6a2f416b0f3d0902689
.dll windows:5 windows x86 arch:x86

3281bc9cc587491038cba87df94ce96f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\GmQczojtjc\kxzjwmxwt\ufckGijoOzvh\RPcmjAdxrwhagw.pdb

Imports

ntoskrnl.exe

RtlInitAnsiString
IoEnumerateDeviceObjectList
RtlDeleteRegistryValue
MmForceSectionClosed
ExReleaseResourceLite
DbgBreakPointWithStatus
DbgBreakPoint
ZwCreateEvent
ZwOpenProcess
CcMdlWriteComplete
KeDetachProcess
PsGetProcessId
MmUnlockPagableImageSection
MmMapLockedPagesSpecifyCache
IoAllocateAdapterChannel
KeQueryActiveProcessors
RtlUnicodeStringToOemString
RtlDeleteNoSplay
IoReleaseRemoveLockEx
PsGetCurrentThreadId
RtlRemoveUnicodePrefix
RtlTimeToTimeFields
ObCreateObject
SeSetSecurityDescriptorInfo
MmBuildMdlForNonPagedPool
ZwMapViewOfSection
IoGetRequestorProcessId
KeSetBasePriorityThread
IoAcquireCancelSpinLock
KeReadStateTimer
IoGetAttachedDevice
RtlSecondsSince1970ToTime
IoSetThreadHardErrorMode
IoRequestDeviceEject
IoGetRelatedDeviceObject
RtlAppendStringToString
RtlUnicodeStringToAnsiString
MmFreeNonCachedMemory
KeInitializeApc
IoGetDeviceAttachmentBaseRef
FsRtlFastCheckLockForRead
SeCaptureSubjectContext
KeRegisterBugCheckCallback
KeWaitForMultipleObjects
RtlFindClearRuns
RtlMultiByteToUnicodeN
ZwDeleteValueKey
ExSetResourceOwnerPointer
RtlMapGenericMask
ZwQuerySymbolicLinkObject
RtlDelete
PsCreateSystemThread
ZwCreateSection
KeGetCurrentThread
IoOpenDeviceRegistryKey
DbgPrompt
SeValidSecurityDescriptor
IofCompleteRequest
CcUnpinData
SeCreateClientSecurity
KeReleaseSemaphore
RtlCheckRegistryKey
KeSetTimer
FsRtlDeregisterUncProvider
SeSinglePrivilegeCheck
RtlCreateUnicodeString
ZwClose
RtlCopySid
IofCallDriver
RtlLengthSid
IoVerifyPartitionTable
ExAllocatePoolWithTag
ObGetObjectSecurity
PsSetLoadImageNotifyRoutine
RtlInitUnicodeString
RtlEqualSid
RtlCreateAcl
PsTerminateSystemThread
CcSetReadAheadGranularity
RtlGenerate8dot3Name
FsRtlIsDbcsInExpression
MmPageEntireDriver
MmMapIoSpace
CcFastCopyRead
IoInvalidateDeviceState
KeInsertHeadQueue
PsLookupProcessByProcessId
IoGetStackLimits
PsGetThreadProcessId
RtlCreateRegistryKey
SeFilterToken
CcUnpinDataForThread
IoFreeMdl
KeFlushQueuedDpcs
RtlAnsiCharToUnicodeChar
RtlAddAccessAllowedAceEx
PsRevertToSelf
MmAllocateMappingAddress
RtlInitializeBitMap
IoWritePartitionTableEx
IoCsqRemoveIrp
FsRtlAllocateFileLock
ObfDereferenceObject
ZwEnumerateKey
CcPinMappedData
SeTokenIsAdmin
KeInsertQueue
ZwUnloadDriver
PsDereferencePrimaryToken
RtlFreeUnicodeString
SeAppendPrivileges
RtlTimeToSecondsSince1970
IoRemoveShareAccess
ExSystemTimeToLocalTime
FsRtlGetNextFileLock
IoDeleteSymbolicLink
MmAdvanceMdl
KeSetTargetProcessorDpc
KdDisableDebugger
ExDeletePagedLookasideList
ExLocalTimeToSystemTime
KeLeaveCriticalRegion
MmIsVerifierEnabled
RtlUpcaseUnicodeToOemN
ExNotifyCallback
RtlDowncaseUnicodeString
ZwCreateDirectoryObject
ProbeForWrite
IoAllocateMdl
RtlUnicodeToOemN
MmAllocateNonCachedMemory
KeSetEvent
ExVerifySuite
RtlFindClearBits
ZwQueryValueKey
ZwWriteFile
KeSetImportanceDpc
IoCreateStreamFileObject
SeUnlockSubjectContext
CcFastCopyWrite
KefAcquireSpinLockAtDpcLevel
ExAllocatePoolWithQuotaTag
IoCancelIrp
ZwOpenSection
ExDeleteResourceLite
RtlExtendedIntegerMultiply
MmUnmapLockedPages
FsRtlMdlWriteCompleteDev
PoStartNextPowerIrp
IoRegisterDeviceInterface
MmUnmapReservedMapping
RtlAreBitsClear
MmUnlockPages
IoVerifyVolume
ExRaiseAccessViolation
SeImpersonateClientEx
FsRtlCheckLockForReadAccess
IoBuildSynchronousFsdRequest
SeTokenIsRestricted
RtlCreateSecurityDescriptor
KeQueryTimeIncrement
IoGetRequestorProcess
RtlAnsiStringToUnicodeString
MmFlushImageSection
MmCanFileBeTruncated
SeOpenObjectAuditAlarm
ObInsertObject
IoSetSystemPartition
RtlFindLastBackwardRunClear
SeDeassignSecurity
RtlAppendUnicodeToString
KdEnableDebugger
RtlUnicodeStringToInteger
FsRtlCheckOplock
ExGetSharedWaiterCount
IoStartNextPacket
IoReleaseVpbSpinLock
CcMdlWriteAbort
PoSetPowerState
RtlFindNextForwardRunClear
IoCreateFile
PoSetSystemState
ZwAllocateVirtualMemory
KeReadStateMutex
IoQueueWorkItem
IoAcquireRemoveLockEx
IoInitializeRemoveLockEx
IoWriteErrorLogEntry
RtlVolumeDeviceToDosName
RtlGetNextRange
IoGetCurrentProcess
IoStopTimer
IoIsWdmVersionAvailable
IoCheckEaBufferValidity
IoStartPacket
IoRaiseHardError
KeInitializeEvent
IoGetLowerDeviceObject
ExRaiseStatus
RtlInitializeGenericTable
MmIsThisAnNtAsSystem
RtlInitializeUnicodePrefix
MmFreeContiguousMemory
KeReadStateEvent
MmHighestUserAddress
IoReadDiskSignature
KeBugCheckEx
RtlIntegerToUnicodeString
RtlSecondsSince1980ToTime
ExFreePoolWithTag
MmAllocatePagesForMdl
MmResetDriverPaging
RtlInitializeSid
IoUnregisterFileSystem
KeRemoveEntryDeviceQueue
RtlNtStatusToDosError
ZwQueryObject
PsReturnPoolQuota
MmMapLockedPages
RtlPrefixUnicodeString
MmIsAddressValid
MmGetPhysicalAddress
IoGetTopLevelIrp
RtlAddAccessAllowedAce
IoAllocateController
RtlIsNameLegalDOS8Dot3
RtlGetVersion
IoWMIWriteEvent
FsRtlIsTotalDeviceFailure
RtlFindMostSignificantBit
CcDeferWrite
RtlSetBits
RtlCharToInteger
CcUnpinRepinnedBcb
KeInitializeDeviceQueue
RtlGetCallersAddress
CcSetDirtyPinnedData
ObfReferenceObject
KeRemoveQueue
KeDelayExecutionThread
IoThreadToProcess
ZwQueryInformationFile
KeInsertQueueDpc
RtlTimeToSecondsSince1980
RtlCopyLuid
ZwFsControlFile
KeClearEvent
IoDeleteController
RtlLengthRequiredSid
ZwMakeTemporaryObject
KeQueryInterruptTime
IoRegisterFileSystem
KePulseEvent
RtlHashUnicodeString
RtlFillMemoryUlong
MmQuerySystemSize
KeReadStateSemaphore
RtlWriteRegistryValue

Exports

Exports

?IsNotStateExW@@YGMHPAF&U
?IsValidTimerExW@@YGPAXK&U
?CancelWidthExA@@YGEEE&U
?RemoveDate@@YGPAJMNKK&U
?KillThreadA@@YGPAK_N_NPAKPAF&U
?ShowComponentW@@YGFDPAH&U
?InsertSectionEx@@YGDD&U
?SendArgument@@YGPANFH&U
?CancelStringExA@@YGXJPAFE&U
?GenerateProfileOriginal@@YGGPAF&U
?FormatTimeEx@@YGHMFEPAN&U
?Text@@YGPADMKG&U
?CrtFolderEx@@YGMD&U
?AddAppName@@YGPAXMHPAGF&U
?CloseDateTimeA@@YGPAEPAHJJPAJ&U
?PathExW@@YGXIPAIPA_N&U
?FormatFilePathExW@@YGPAGMPAK&U
?HideProfileOld@@YGXPAF_NPAJPAJ&U
?RtlProjectW@@YGPAIPAE&U
?SendPointerA@@YGPADMPADD&U
?SendNameNew@@YGPAHGPAJ&U
?FormatArgumentExA@@YGPAXPAH&U
?GlobalComponentA@@YGMMIPA_N&U
?IsNotProjectA@@YGPAFPADPAMPAHI&U
?LoadAnchorExW@@YGPAHD&U
?ShowComponentEx@@YGPANPAEPAF&U
?ShowProviderW@@YGJGM&U
?RtlTaskNew@@YG_NH&U
?LoadExpressionA@@YGPAXGEI&U
?EnumSizeEx@@YGKPAMMPAJJ&U
?DeleteCommandLineA@@YGXFJ&U
?ValidateArgumentOriginal@@YGDGPAG&U
?FindDataA@@YGPAEKGE&U
?CancelThreadW@@YGPAH_N_NH&U
?CrtDeviceOld@@YGMPAJPA_NPAH_N&U
?ShowEventA@@YGPAJHJKH&U
?CallMediaTypeExW@@YGPAMPA_N&U
?CrtFolderNew@@YGGMEMM&U

Sections

.text
Size: 29KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.i_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e_data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hosta
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hostb
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hostd
Size: 1024B - Virtual size: 569B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3281bc9cc587491038cba87df94ce96f

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 53KB

.i_data Size: 1KB - Virtual size: 1KB

.e_data Size: 1KB - Virtual size: 1KB

.hostc Size: 512B - Virtual size: 28B

.hosta Size: 512B - Virtual size: 44B

.hostb Size: 512B - Virtual size: 44B

.hostd Size: 1024B - Virtual size: 569B

.data Size: 34KB - Virtual size: 34KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 1024B - Virtual size: 668B

.text
Size: 29KB - Virtual size: 53KB

.i_data
Size: 1KB - Virtual size: 1KB

.e_data
Size: 1KB - Virtual size: 1KB

.hostc
Size: 512B - Virtual size: 28B

.hosta
Size: 512B - Virtual size: 44B

.hostb
Size: 512B - Virtual size: 44B

.hostd
Size: 1024B - Virtual size: 569B

.data
Size: 34KB - Virtual size: 34KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 668B