Static task
static1
Behavioral task
behavioral1
Sample
089e83d6eea2626badbe8c46bd86f045f9dec5ac5b7c16b44b089c2c73d2036d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
089e83d6eea2626badbe8c46bd86f045f9dec5ac5b7c16b44b089c2c73d2036d.dll
Resource
win10v2004-20240704-en
General
-
Target
089e83d6eea2626badbe8c46bd86f045f9dec5ac5b7c16b44b089c2c73d2036d.exe
-
Size
732KB
-
MD5
faa546f74d8717ffe3cfebaf127528f0
-
SHA1
2578b6e225c565ca6818d0a07dfe763e9c49af1a
-
SHA256
089e83d6eea2626badbe8c46bd86f045f9dec5ac5b7c16b44b089c2c73d2036d
-
SHA512
5b8d80c2f86d354a12643241eb2423db1a6b590fe687c2def928ffb59806db3e8c76ddd341b2090d470ca409cc73df553aac02e779b5ebb52c24d6953a512d67
-
SSDEEP
12288:lraY5GYn2HV8Ap4KFL9quFH5OOLSos5tvOrASqmR:taIG82HVrpjpq65t5+G3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 089e83d6eea2626badbe8c46bd86f045f9dec5ac5b7c16b44b089c2c73d2036d.exe
Files
-
089e83d6eea2626badbe8c46bd86f045f9dec5ac5b7c16b44b089c2c73d2036d.exe.dll windows:5 windows x86 arch:x86
175433a74051bcb7f3f06f6ca0c7274c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
hal
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
ntoskrnl.exe
CcCanIWrite
CcCopyRead
CcCopyWrite
CcDeferWrite
CcFlushCache
CcInitializeCacheMap
CcMdlReadComplete
CcMdlWriteComplete
CcPurgeCacheSection
CcSetFileSizes
CcSetReadAheadGranularity
CcUninitializeCacheMap
DbgPrint
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExAllocatePoolWithTag
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
ExFreePool
ExInitializeResourceLite
ExInitializeZone
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExLocalTimeToSystemTime
ExQueueWorkItem
ExRaiseStatus
ExReleaseResourceForThreadLite
ExSystemTimeToLocalTime
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlCopyRead
FsRtlCopyWrite
FsRtlDoesNameContainWildCards
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlInitializeFileLock
FsRtlIsNameInExpression
FsRtlIsNtstatusExpected
FsRtlNormalizeNtstatus
FsRtlNotifyCleanup
FsRtlNotifyFullChangeDirectory
FsRtlNotifyFullReportChange
FsRtlNotifyInitializeSync
FsRtlNotifyUninitializeSync
FsRtlPostStackOverflow
FsRtlPrivateLock
FsRtlProcessFileLock
FsRtlUninitializeFileLock
IoAcquireVpbSpinLock
IoAllocateMdl
IoAttachDeviceByPointer
IoBuildAsynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoBuildSynchronousFsdRequest
IoCheckShareAccess
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoFileObjectType
IoFreeIrp
IoFreeMdl
IoGetAttachedDevice
IoGetCurrentProcess
IoGetDeviceObjectPointer
IoGetDeviceToVerify
IoGetRequestorProcess
IoGetStackLimits
IoGetTopLevelIrp
IoIsOperationSynchronous
IoRaiseHardError
IoRegisterFileSystem
IoRegisterFsRegistrationChange
IoRegisterShutdownNotification
IoReleaseVpbSpinLock
IoRemoveShareAccess
IoSetDeviceToVerify
IoSetHardErrorOrVerifyDevice
IoSetShareAccess
IoSetTopLevelIrp
IoUnregisterFileSystem
IoUnregisterShutdownNotification
IoUpdateShareAccess
IoVerifyVolume
IofCallDriver
IofCompleteRequest
KeDelayExecutionThread
KeEnterCriticalRegion
KeGetCurrentThread
KeInitializeEvent
KeLeaveCriticalRegion
KeNumberProcessors
KeQuerySystemTime
KeSetEvent
KeWaitForSingleObject
MmCanFileBeTruncated
MmFlushImageSection
MmIsThisAnNtAsSystem
MmMapLockedPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
MmQuerySystemSize
MmUnlockPages
ObReferenceObjectByHandle
ObfDereferenceObject
ProbeForRead
ProbeForWrite
PsGetCurrentProcessId
PsGetCurrentThreadId
RtlAppendUnicodeToString
RtlAssert
RtlCompareMemory
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlFreeUnicodeString
RtlGenerate8dot3Name
RtlInitUnicodeString
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlUnwind
RtlUpcaseUnicodeString
SeExports
SeSinglePrivilegeCheck
ZwClose
ZwCreateFile
ZwDeviceIoControlFile
ZwFsControlFile
ZwOpenKey
ZwQueryValueKey
ZwQueryVolumeInformationFile
memcpy
memmove
memset
sprintf
wcslen
Sections
.text Size: 284KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 4KB - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 644B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 49B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 384KB - Virtual size: 380KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ