R:\wmqJIwTlirlpDe\ZSjVfwlvuvseOr\wdpcxdhFA\cnuemolPtgBj.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d68504ff759657bf3896bd457b010ae1.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d68504ff759657bf3896bd457b010ae1.dll
Resource
win10v2004-20240226-en
General
-
Target
d68504ff759657bf3896bd457b010ae1
-
Size
181KB
-
MD5
d68504ff759657bf3896bd457b010ae1
-
SHA1
e5b3e59371ec4231f6248d30718ae6c4bf653dc0
-
SHA256
fb3dea4929eb70c7ecaa745644436c6bd00b54d7ac8ecec3c7c5ae781f3b49aa
-
SHA512
4ce290bbf125ccb66e0d41ea718084bbc00790e9a9b4f9259a2d6ab8a33e63734364bd62a8a4dfcf0e5f1e4ae604629773c315f65665769d8b529171756882c0
-
SSDEEP
3072:Hus9wlVtXJ7sP9IcFsN+msn8REcitf0+R3TKEUx41eR:59wvYR8REztfDRDEM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d68504ff759657bf3896bd457b010ae1
Files
-
d68504ff759657bf3896bd457b010ae1.dll windows:5 windows x86 arch:x86
59415528ff9462a52ab210cf275c5304
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlCopyString
ExInitializeResourceLite
IoCreateNotificationEvent
IoReuseIrp
RtlFindClearRuns
RtlUnicodeStringToInteger
FsRtlIsFatDbcsLegal
IoDeleteSymbolicLink
ProbeForWrite
IoGetAttachedDevice
RtlFindSetBits
SeQueryInformationToken
MmProbeAndLockPages
IoGetDeviceInterfaces
ExGetExclusiveWaiterCount
RtlInsertUnicodePrefix
IoDeviceObjectType
ExAcquireFastMutexUnsafe
KeInsertQueue
KeDelayExecutionThread
RtlInitializeBitMap
KeInitializeDpc
PoSetSystemState
PsLookupThreadByThreadId
IoGetDeviceInterfaceAlias
SeDeleteObjectAuditAlarm
MmSizeOfMdl
RtlInitializeGenericTable
FsRtlSplitLargeMcb
IoConnectInterrupt
RtlEqualUnicodeString
RtlFindClearBits
PoStartNextPowerIrp
KeRundownQueue
RtlCharToInteger
RtlUpcaseUnicodeChar
KdEnableDebugger
MmHighestUserAddress
ZwQueryVolumeInformationFile
MmIsDriverVerifying
KeSaveFloatingPointState
ZwEnumerateValueKey
ZwFlushKey
FsRtlGetNextFileLock
KeInsertDeviceQueue
IoDeleteController
FsRtlIsNameInExpression
FsRtlCheckLockForReadAccess
ZwQueryValueKey
RtlGetVersion
IoOpenDeviceRegistryKey
RtlSubAuthoritySid
MmGetPhysicalAddress
PsGetCurrentProcessId
FsRtlIsDbcsInExpression
MmAllocateContiguousMemory
RtlTimeToSecondsSince1980
ExFreePoolWithTag
IoBuildPartialMdl
RtlAreBitsSet
RtlTimeFieldsToTime
IoStopTimer
RtlSetAllBits
CcSetBcbOwnerPointer
RtlUnicodeToMultiByteN
RtlNumberOfClearBits
IoGetRelatedDeviceObject
RtlInitializeSid
FsRtlDeregisterUncProvider
IoAcquireCancelSpinLock
ZwOpenSection
IoDeleteDevice
PoRequestPowerIrp
RtlCheckRegistryKey
SeCaptureSubjectContext
IoGetDeviceObjectPointer
IoAllocateWorkItem
IoRequestDeviceEject
RtlFillMemoryUlong
KeInitializeTimer
ExDeleteResourceLite
MmPageEntireDriver
RtlStringFromGUID
KeReadStateSemaphore
KeStackAttachProcess
KeGetCurrentThread
IoCancelIrp
ExVerifySuite
KeBugCheck
RtlUpcaseUnicodeString
PoSetPowerState
ExReinitializeResourceLite
IoRegisterDeviceInterface
RtlCopySid
KeRemoveQueue
RtlAddAccessAllowedAceEx
IoRaiseHardError
IoUpdateShareAccess
RtlNtStatusToDosError
RtlDowncaseUnicodeString
RtlDeleteRegistryValue
KeWaitForMultipleObjects
RtlMultiByteToUnicodeN
KdDisableDebugger
KeReleaseSemaphore
ZwMapViewOfSection
PsIsThreadTerminating
ExAcquireResourceSharedLite
FsRtlFastUnlockSingle
ZwOpenFile
KeRemoveDeviceQueue
IoStartTimer
RtlCopyLuid
IoIsWdmVersionAvailable
PsTerminateSystemThread
RtlValidSecurityDescriptor
KeSetTimer
RtlRandom
RtlGetNextRange
ExSystemTimeToLocalTime
ZwDeleteKey
RtlAnsiStringToUnicodeString
RtlVerifyVersionInfo
MmQuerySystemSize
KeFlushQueuedDpcs
MmSecureVirtualMemory
IoWriteErrorLogEntry
KeUnstackDetachProcess
ExDeletePagedLookasideList
SeCreateClientSecurity
RtlFindLastBackwardRunClear
MmAllocateNonCachedMemory
RtlInt64ToUnicodeString
ExAllocatePoolWithQuotaTag
CcFastMdlReadWait
PsGetVersion
RtlOemStringToUnicodeString
ExAllocatePoolWithTag
KeCancelTimer
RtlCopyUnicodeString
PoUnregisterSystemState
DbgBreakPointWithStatus
ZwOpenSymbolicLinkObject
RtlInitAnsiString
FsRtlCheckLockForWriteAccess
ExSetTimerResolution
SeValidSecurityDescriptor
KeResetEvent
RtlClearBits
ObGetObjectSecurity
FsRtlNotifyInitializeSync
CcDeferWrite
IoSetThreadHardErrorMode
IoStartPacket
MmCanFileBeTruncated
ZwCreateFile
SeImpersonateClientEx
CcFastCopyWrite
ZwCreateKey
IoCreateSynchronizationEvent
ZwDeleteValueKey
MmFreeNonCachedMemory
KeRemoveByKeyDeviceQueue
RtlSetDaclSecurityDescriptor
RtlQueryRegistryValues
KeReadStateEvent
ExCreateCallback
KeRemoveQueueDpc
FsRtlAllocateFileLock
MmBuildMdlForNonPagedPool
IoCheckQuotaBufferValidity
ExNotifyCallback
IoSetSystemPartition
ExFreePool
RtlTimeToTimeFields
RtlMapGenericMask
FsRtlLookupLastLargeMcbEntry
ZwQueryInformationFile
PsCreateSystemThread
ExReleaseFastMutexUnsafe
RtlGUIDFromString
MmMapIoSpace
IoCreateSymbolicLink
MmLockPagableSectionByHandle
ZwQueryObject
KeDeregisterBugCheckCallback
KeInitializeEvent
IoGetDeviceProperty
ZwQueryKey
RtlUpperChar
IoSetShareAccess
IoGetStackLimits
RtlCreateSecurityDescriptor
PsGetCurrentProcess
KeInitializeSpinLock
CcCopyRead
IoGetDeviceToVerify
FsRtlIsHpfsDbcsLegal
IoGetAttachedDeviceReference
SeSinglePrivilegeCheck
PsLookupProcessByProcessId
IoCreateFile
IoGetBootDiskInformation
IoBuildSynchronousFsdRequest
MmResetDriverPaging
MmMapLockedPagesSpecifyCache
RtlLengthSecurityDescriptor
ZwQuerySymbolicLinkObject
IoAttachDeviceToDeviceStack
RtlTimeToSecondsSince1970
RtlFindMostSignificantBit
RtlxAnsiStringToUnicodeSize
RtlUpperString
RtlEqualSid
SeDeassignSecurity
IoCheckShareAccess
RtlCompareString
ZwReadFile
IoWMIRegistrationControl
RtlAnsiCharToUnicodeChar
PsGetCurrentThreadId
IoGetRequestorProcessId
MmIsAddressValid
ExRaiseStatus
RtlClearAllBits
PsGetCurrentThread
IoAllocateErrorLogEntry
ZwAllocateVirtualMemory
ExIsProcessorFeaturePresent
SeQueryAuthenticationIdToken
ObReferenceObjectByPointer
MmFreeContiguousMemory
IoInitializeTimer
RtlLengthRequiredSid
MmForceSectionClosed
RtlCompareMemory
KeRemoveEntryDeviceQueue
ExGetSharedWaiterCount
IoQueueWorkItem
PsSetLoadImageNotifyRoutine
CcCopyWrite
RtlInitUnicodeString
IoReportDetectedDevice
IoDisconnectInterrupt
ExUnregisterCallback
RtlWriteRegistryValue
IoInitializeIrp
CcZeroData
KeInitializeQueue
KeInitializeApc
RtlCreateUnicodeString
KeSetTargetProcessorDpc
IoInvalidateDeviceState
KeSetTimerEx
RtlValidSid
ExLocalTimeToSystemTime
IoStartNextPacket
KeSetPriorityThread
RtlFindClearBitsAndSet
MmUnmapLockedPages
Sections
.text Size: 34KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ