F:\SUrTcglmnhwuAL\ygxzgUgEPv\kbyxlwwFTj\gZtbkerEgbygax\MnqKteaRgaSKe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4a9d665c684d4e976a2ba2033550cb01a977a788c3d243e92ee42da510ea9eb2N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a9d665c684d4e976a2ba2033550cb01a977a788c3d243e92ee42da510ea9eb2N.dll
Resource
win10v2004-20240802-en
General
-
Target
4a9d665c684d4e976a2ba2033550cb01a977a788c3d243e92ee42da510ea9eb2N
-
Size
61KB
-
MD5
e7098b13c51dfd5caf4b223f7fb29390
-
SHA1
5eaf62c7113182c0d42cbf046399ec00e86e4683
-
SHA256
4a9d665c684d4e976a2ba2033550cb01a977a788c3d243e92ee42da510ea9eb2
-
SHA512
7a0d40d8f2e3f073ac894819e490315e995c96fb8e8d46ce81fef1a2647177db338e6fa211cc5b7d67de2222746e0bababaaf3204308152622983474a3528255
-
SSDEEP
768:b3omZaxuPNLoSaqhm1cpUCN7QhjLNbCyibBjuZZ/8EZhWSHuwRZigcEHejr/mrl:b1p4qhm1cPFKXNbcViZZ/3ZhnjrdeHe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a9d665c684d4e976a2ba2033550cb01a977a788c3d243e92ee42da510ea9eb2N
Files
-
4a9d665c684d4e976a2ba2033550cb01a977a788c3d243e92ee42da510ea9eb2N.dll windows:5 windows x86 arch:x86
c19666e1440b4c65e568900084a8aa36
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ZwQueryInformationFile
RtlFreeAnsiString
KeWaitForMultipleObjects
RtlLengthRequiredSid
RtlInitializeGenericTable
MmUnlockPages
KeSetKernelStackSwapEnable
RtlSubAuthoritySid
IoSetPartitionInformationEx
ExGetPreviousMode
CcSetDirtyPinnedData
CcInitializeCacheMap
MmProbeAndLockPages
RtlCompareUnicodeString
ZwWriteFile
MmGetSystemRoutineAddress
PsGetVersion
ExSetTimerResolution
MmAddVerifierThunks
IoWritePartitionTableEx
ObfReferenceObject
KeRevertToUserAffinityThread
CcUninitializeCacheMap
RtlInitAnsiString
RtlInt64ToUnicodeString
IoDetachDevice
CcMdlRead
KeWaitForSingleObject
MmFreeNonCachedMemory
RtlAreBitsSet
KeInsertQueueDpc
RtlInitUnicodeString
CcPinMappedData
ZwAllocateVirtualMemory
SeAssignSecurity
RtlRandom
ZwSetValueKey
IoGetDriverObjectExtension
KeInitializeDeviceQueue
ZwDeviceIoControlFile
ExDeletePagedLookasideList
IoAcquireVpbSpinLock
IoThreadToProcess
ObInsertObject
KeInitializeDpc
CcCopyRead
IofCompleteRequest
FsRtlNotifyInitializeSync
KeSaveFloatingPointState
IoReportResourceForDetection
RtlUnicodeStringToAnsiString
IoStopTimer
IoCreateNotificationEvent
IoRemoveShareAccess
KeRemoveQueue
MmSetAddressRangeModified
RtlInitString
RtlUpcaseUnicodeToOemN
RtlUnicodeToOemN
IoRegisterFileSystem
SeCreateClientSecurity
PsGetCurrentThread
ExFreePoolWithTag
MmResetDriverPaging
RtlAddAccessAllowedAce
MmCanFileBeTruncated
RtlxOemStringToUnicodeSize
KdDisableDebugger
RtlExtendedIntegerMultiply
MmLockPagableDataSection
SeAppendPrivileges
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
CcPinRead
IoIsOperationSynchronous
IoGetCurrentProcess
ExNotifyCallback
IoFreeIrp
ExAllocatePoolWithQuota
ZwNotifyChangeKey
IoAllocateWorkItem
IoSetPartitionInformation
PsGetCurrentThreadId
KeFlushQueuedDpcs
ExInitializeResourceLite
CcMdlReadComplete
RtlCharToInteger
KefAcquireSpinLockAtDpcLevel
KeSynchronizeExecution
PsChargeProcessPoolQuota
IoQueueWorkItem
RtlCopyUnicodeString
IoStartNextPacket
SeUnlockSubjectContext
RtlFindLastBackwardRunClear
RtlIsNameLegalDOS8Dot3
ExReinitializeResourceLite
IoGetDeviceAttachmentBaseRef
IoGetDiskDeviceObject
IoIsSystemThread
KeBugCheck
IoRequestDeviceEject
RtlGetCallersAddress
MmSecureVirtualMemory
MmMapLockedPages
PsReturnPoolQuota
IoMakeAssociatedIrp
SeTokenIsAdmin
MmUnmapLockedPages
CcMapData
RtlDeleteNoSplay
MmFreePagesFromMdl
PoCallDriver
SeFilterToken
FsRtlIsNameInExpression
IoInitializeIrp
ExUuidCreate
CcSetBcbOwnerPointer
IoBuildPartialMdl
IoCreateSymbolicLink
KeSetTimerEx
SeQueryInformationToken
RtlCopyLuid
ZwMakeTemporaryObject
IoReleaseVpbSpinLock
FsRtlDeregisterUncProvider
RtlCreateRegistryKey
ObMakeTemporaryObject
IoAllocateAdapterChannel
SeFreePrivileges
KeRemoveEntryDeviceQueue
IoDisconnectInterrupt
ExAcquireFastMutexUnsafe
HalExamineMBR
RtlTimeToSecondsSince1970
CcFastMdlReadWait
ZwReadFile
IoDeleteSymbolicLink
KeSetBasePriorityThread
IoWriteErrorLogEntry
IoGetRelatedDeviceObject
PsLookupThreadByThreadId
MmAllocateMappingAddress
ExSetResourceOwnerPointer
KeRestoreFloatingPointState
CcUnpinDataForThread
RtlAreBitsClear
PsRevertToSelf
MmLockPagableSectionByHandle
KeInitializeQueue
KeInitializeApc
KeRundownQueue
IoAllocateMdl
IoConnectInterrupt
ExAllocatePool
CcFastCopyRead
ExUnregisterCallback
IoSetHardErrorOrVerifyDevice
IoAcquireRemoveLockEx
IoGetTopLevelIrp
RtlFindNextForwardRunClear
RtlGetNextRange
KeEnterCriticalRegion
RtlAppendStringToString
IoGetRequestorProcess
IoGetStackLimits
PsCreateSystemThread
RtlStringFromGUID
RtlTimeToSecondsSince1980
PsGetCurrentProcess
FsRtlFastCheckLockForRead
RtlFreeOemString
RtlEqualSid
KeInsertQueue
KeAttachProcess
KeGetCurrentThread
RtlClearBits
ZwFlushKey
IoGetDeviceInterfaces
IoQueryFileDosDeviceName
KeQueryActiveProcessors
IoGetLowerDeviceObject
PoStartNextPowerIrp
IoRaiseHardError
IoFreeErrorLogEntry
IoBuildSynchronousFsdRequest
CcSetFileSizes
KeCancelTimer
IoReleaseRemoveLockAndWaitEx
IoAllocateIrp
CcMdlWriteComplete
KeSetImportanceDpc
KeReleaseSemaphore
RtlSplay
RtlSetBits
FsRtlIsDbcsInExpression
IoReadDiskSignature
ObReferenceObjectByPointer
MmUnmapIoSpace
KeSetTimer
MmMapIoSpace
IoSetStartIoAttributes
MmUnlockPagableImageSection
ObOpenObjectByPointer
RtlNumberOfClearBits
SeDeassignSecurity
MmIsThisAnNtAsSystem
SeSetSecurityDescriptorInfo
KeQuerySystemTime
IoStartTimer
ZwCreateSection
KeInitializeMutex
KeInitializeTimer
IoIsWdmVersionAvailable
RtlFindClearBits
IoReadPartitionTable
IoCancelIrp
RtlFindMostSignificantBit
MmProbeAndLockProcessPages
FsRtlAllocateFileLock
DbgPrompt
IoCreateStreamFileObjectLite
PoRequestPowerIrp
IoQueryDeviceDescription
RtlVolumeDeviceToDosName
SeAccessCheck
FsRtlFastUnlockSingle
PsGetThreadProcessId
IoDeleteController
RtlEqualUnicodeString
IoCreateDisk
MmAllocateContiguousMemory
PsGetCurrentProcessId
RtlCreateUnicodeString
MmGetPhysicalAddress
RtlCreateAcl
RtlSetAllBits
RtlSecondsSince1970ToTime
ZwDeleteValueKey
ExRaiseStatus
RtlSecondsSince1980ToTime
KeBugCheckEx
RtlLengthSecurityDescriptor
ZwQuerySymbolicLinkObject
RtlUnicodeToMultiByteN
SeReleaseSubjectContext
PsIsThreadTerminating
ZwLoadDriver
RtlQueryRegistryValues
IoReadPartitionTableEx
IoGetDeviceToVerify
RtlValidSecurityDescriptor
KeReadStateSemaphore
KeInsertHeadQueue
CcGetFileObjectFromBcb
SeCaptureSubjectContext
ProbeForRead
RtlGenerate8dot3Name
FsRtlIsTotalDeviceFailure
RtlFindClearBitsAndSet
CcRemapBcb
IoCreateDevice
CcRepinBcb
Exports
Exports
?CallKeyNameOriginal@@YGEIK]A
?InsertFolder@@YGIPAFPAN]A
?DeletePathExA@@YGNKKH]A
?LoadWidthNew@@YGPADIGK]A
?GenerateProjectEx@@YGJI]A
?HideListItemA@@YGKGD]A
?IsNotMutantOriginal@@YGPAKHPAM]A
?ValidateStringOriginal@@YGJHPAN]A
?ValidateMutexW@@YGJPAEPAGIPAN]A
?IsWindowNew@@YGHEPAJPAMK]A
?GenerateDirectoryNew@@YGKPAFPADJ]A
?IsNotNameW@@YGXHK]A
?GetPointerOld@@YGMEF]A
?GlobalVersion@@YGEEPAH]A
?SendProjectOriginal@@YGPAIPA_ND]A
?PutKeyNameEx@@YGPADDHFK]A
?EnumMessage@@YGPAMPAJ]A
?ModifyValueA@@YGXPAGE]A
?CancelVersionW@@YGXPAJPAH]A
?IsSemaphoreOld@@YGID]A
?InsertDeviceExA@@YGXEPA_NPAN]A
?CallAppNameEx@@YGFG]A
?InstallProjectExW@@YGPAXGG]A
?FindCharW@@YGHI]A
?InstallCharW@@YGDKH_NH]A
?GlobalStringNew@@YGPAJPAD]A
?DecrementFunctionW@@YGEF]A
?ValidateFolderOld@@YG_NGF]A
?RemoveMessageOriginal@@YGIPAGJM]A
?CloseNameExW@@YGPAGPAE]A
?IsValidPenExW@@YGIDPAF]A
?LoadProviderEx@@YGPAX_NPAF]A
Sections
.text Size: 29KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ