C:\NhVjpqxy\dngw\eQwVean.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fb30c39e243cfe7b57fedd6624ad34ca747449124b3472c178219eed41e45165N.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fb30c39e243cfe7b57fedd6624ad34ca747449124b3472c178219eed41e45165N.dll
Resource
win10v2004-20240802-en
General
-
Target
fb30c39e243cfe7b57fedd6624ad34ca747449124b3472c178219eed41e45165N
-
Size
44KB
-
MD5
e54fceb5a02d1fd9439794f8ec104b10
-
SHA1
cdb64f5c20e16dace78b7ed4209737f4f500928a
-
SHA256
fb30c39e243cfe7b57fedd6624ad34ca747449124b3472c178219eed41e45165
-
SHA512
7fecb1e09c2a074938ae9fd12a2f6cdf1fc9ab140a87cf95dd2491cc66204ea5dd98b59befbe33d776d3baf8263275c5d278dfa586a2ce5daf1ca09251c52583
-
SSDEEP
768:aWW98zyTKeyh+k+OL+zsDhSpNIZwhs9crkjFudF:aWW+eOeyht+gwzIyhs9cE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb30c39e243cfe7b57fedd6624ad34ca747449124b3472c178219eed41e45165N
Files
-
fb30c39e243cfe7b57fedd6624ad34ca747449124b3472c178219eed41e45165N.dll windows:5 windows x86 arch:x86
9e673ae853f24241fddbc3aac4f7de49
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
FsRtlCheckOplock
IoGetStackLimits
KeSynchronizeExecution
ExRaiseAccessViolation
KeRegisterBugCheckCallback
RtlUnicodeToMultiByteN
RtlCompareString
IoSetThreadHardErrorMode
KdEnableDebugger
RtlFillMemoryUlong
RtlxAnsiStringToUnicodeSize
KeInitializeEvent
SeQueryInformationToken
IoInvalidateDeviceRelations
IoRequestDeviceEject
PoSetPowerState
RtlFindNextForwardRunClear
KeRemoveEntryDeviceQueue
KeEnterCriticalRegion
PsCreateSystemThread
RtlInitString
IoRaiseHardError
RtlEqualString
IoInitializeTimer
FsRtlCheckLockForReadAccess
ZwEnumerateValueKey
Exports
Exports
?SEvkxvfxdc@@YGMPAG@Z
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ