Spyware
Trojan.GenericKDZ.76753 Gen:Variant.Mikey.113998
Created on 2021-09-28T10:53:00
dc684f824a7deaf6028f6266b48cc3f982a4931ce2db003f692a448da8e255e3.exe.dll
Remarks (2/2)
(0x02000009): DLL files normally need to be submitted with an appropriate loader. Analysis result may be incomplete if an appropriate loader was not submitted.
(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 hour, 49 minutes, 54 seconds" to "1 minute, 30 seconds" to reveal dormant functionality.
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\RDhJ0CNFevzX\Desktop\dc684f824a7deaf6028f6266b48cc3f982a4931ce2db003f692a448da8e255e3.exe.dll | Sample File | Binary |
malicious
|
...
|
Threat Name | Verdict |
---|---|
Trojan.GenericKDZ.76753 |
malicious
|
Image Base | 0x140000000 |
Entry Point | 0x140041070 |
Size Of Code | 0x41000 |
Size Of Initialized Data | 0xef000 |
File Type | FileType.dll |
Subsystem | Subsystem.windows_cui |
Machine Type | MachineType.amd64 |
Compile Timestamp | 2020-02-20 08:35:24+00:00 |
CompanyName | Microsoft Corporati |
FileDescription | Background Intellig |
FileVersion | 7.5.7600.16385 (win7_rtm.090713- |
InternalName | bitsp |
LegalCopyright | © Microsoft Corporation. All rights reserv |
OriginalFilename | kbdy |
ProductName | Microsoft® Windows® Operating S |
ProductVersion | 6.1.7600 |
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x140001000 | 0x40796 | 0x41000 | 0x1000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.73 |
.rdata | 0x140042000 | 0x64fcb | 0x65000 | 0x42000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.87 |
.data | 0x1400a7000 | 0x178b8 | 0x18000 | 0xa7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.32 |
.pdata | 0x1400bf000 | 0x12c | 0x1000 | 0xbf000 | IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.58 |
.rsrc | 0x1400c0000 | 0x880 | 0x1000 | 0xc0000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.24 |
.reloc | 0x1400c1000 | 0x2324 | 0x3000 | 0xc1000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 4.65 |
.qkm | 0x1400c4000 | 0x74a | 0x1000 | 0xc4000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.cvjb | 0x1400c5000 | 0x1e66 | 0x2000 | 0xc5000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.tlmkv | 0x1400c7000 | 0xbde | 0x1000 | 0xc7000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.wucsxe | 0x1400c8000 | 0x45174 | 0x46000 | 0xc8000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.wnx | 0x14010e000 | 0x8fe | 0x1000 | 0x10e000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.weqy | 0x14010f000 | 0x8fe | 0x1000 | 0x10f000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.yby | 0x140110000 | 0x1278 | 0x2000 | 0x110000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ormx | 0x140112000 | 0xbde | 0x1000 | 0x112000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.dhclu | 0x140113000 | 0x23b | 0x1000 | 0x113000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.xmiul | 0x140114000 | 0x23b | 0x1000 | 0x114000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.tlwcxe | 0x140115000 | 0x13e | 0x1000 | 0x115000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.get | 0x140116000 | 0xbde | 0x1000 | 0x116000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.hzrd | 0x140117000 | 0x1124 | 0x2000 | 0x117000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.gulz | 0x140119000 | 0x1124 | 0x2000 | 0x119000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ybavfq | 0x14011b000 | 0x1af | 0x1000 | 0x11b000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.hzccq | 0x14011c000 | 0x1e66 | 0x2000 | 0x11c000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.kmnqh | 0x14011e000 | 0x736 | 0x1000 | 0x11e000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.sqadf | 0x14011f000 | 0x23b | 0x1000 | 0x11f000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.uans | 0x140120000 | 0x1f2a | 0x2000 | 0x120000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.gelkgq | 0x140122000 | 0x8fe | 0x1000 | 0x122000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.jbviw | 0x140123000 | 0x21b | 0x1000 | 0x123000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ypg | 0x140124000 | 0x2da | 0x1000 | 0x124000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.qqs | 0x140125000 | 0x13e | 0x1000 | 0x125000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.dsy | 0x140126000 | 0x2a2 | 0x1000 | 0x126000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.fgy | 0x140127000 | 0x13e | 0x1000 | 0x127000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.onfp | 0x140128000 | 0xbde | 0x1000 | 0x128000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.clcj | 0x140129000 | 0x128f | 0x2000 | 0x129000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.fhc | 0x14012b000 | 0x3fe | 0x1000 | 0x12b000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.ghxb | 0x14012c000 | 0x8fe | 0x1000 | 0x12c000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.icyh | 0x14012d000 | 0x1f2a | 0x2000 | 0x12d000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.wguyua | 0x14012f000 | 0x1278 | 0x2000 | 0x12f000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.91 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
LookupIconIdFromDirectoryEx | - | 0x140042098 | 0xa64c8 | 0xa64c8 | 0x205 |
WaitForInputIdle | - | 0x1400420a0 | 0xa64d0 | 0xa64d0 | 0x32e |
GetParent | - | 0x1400420a8 | 0xa64d8 | 0xa64d8 | 0x166 |
GetFocus | - | 0x1400420b0 | 0xa64e0 | 0xa64e0 | 0x12e |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CM_Get_Resource_Conflict_DetailsW | - | 0x140042078 | 0xa64a8 | 0xa64a8 | 0x8a |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
DeleteCriticalSection | - | 0x140042038 | 0xa6468 | 0xa6468 | 0xd2 |
DeleteTimerQueue | - | 0x140042040 | 0xa6470 | 0xa6470 | 0xd9 |
TerminateJobObject | - | 0x140042048 | 0xa6478 | 0xa6478 | 0x4cd |
GetFileInformationByHandle | - | 0x140042050 | 0xa6480 | 0xa6480 | 0x1f3 |
GetThreadLocale | - | 0x140042058 | 0xa6488 | 0xa6488 | 0x293 |
GetNamedPipeServerProcessId | - | 0x140042060 | 0xa6490 | 0xa6490 | 0x229 |
GetConsoleFontSize | - | 0x140042068 | 0xa6498 | 0xa6498 | 0x1aa |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateBitmapIndirect | - | 0x140042020 | 0xa6450 | 0xa6450 | 0x2b |
GetPolyFillMode | - | 0x140042028 | 0xa6458 | 0xa6458 | 0x206 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CertGetCTLContextProperty | - | 0x140042010 | 0xa6440 | 0xa6440 | 0x44 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
AddAccessDeniedObjectAce | - | 0x140042000 | 0xa6430 | 0xa6430 | 0x15 |
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ChrCmpIW | - | 0x140042088 | 0xa64b8 | 0xa64b8 | 0xa |
Api name | EAT Address | Ordinal |
---|---|---|
CloseDriver | 0x2d48 | 0x4 |
DefDriverProc | 0x35980 | 0x5 |
DriverCallback | 0x3bf0c | 0x6 |
DrvGetModuleHandle | 0x3ddc0 | 0x7 |
GetDriverModuleHandle | 0x27a24 | 0x8 |
OpenDriver | 0x1106c | 0x9 |
PlaySound | 0xcbd8 | 0xa |
PlaySoundA | 0x2c928 | 0xb |
PlaySoundW | 0x521c | 0xc |
SendDriverMessage | 0x3bb44 | 0xd |
WOWAppExit | 0x3fae8 | 0xe |
auxGetDevCapsA | 0x1dea8 | 0xf |
auxGetDevCapsW | 0x1b8f0 | 0x10 |
auxGetNumDevs | 0x1ac60 | 0x11 |
auxGetVolume | 0x1fdd8 | 0x12 |
auxOutMessage | 0x3df54 | 0x13 |
auxSetVolume | 0x3fba0 | 0x14 |
joyConfigChanged | 0x13908 | 0x15 |
joyGetDevCapsA | 0x2e290 | 0x16 |
joyGetDevCapsW | 0x70ac | 0x17 |
joyGetNumDevs | 0x32f50 | 0x18 |
joyGetPos | 0x2846c | 0x19 |
joyGetPosEx | 0x30910 | 0x1a |
joyGetThreshold | 0x14c88 | 0x1b |
joyReleaseCapture | 0x3d77c | 0x1c |
joySetCapture | 0x38e80 | 0x1d |
joySetThreshold | 0x293a4 | 0x1e |
mciDriverNotify | 0x1d6a4 | 0x1f |
mciDriverYield | 0x3aa34 | 0x20 |
mciExecute | 0x39240 | 0x3 |
mciFreeCommandResource | 0x3f130 | 0x21 |
mciGetCreatorTask | 0x20c3c | 0x22 |
mciGetDeviceIDA | 0x31974 | 0x23 |
mciGetDeviceIDFromElementIDA | 0x2ee64 | 0x24 |
mciGetDeviceIDFromElementIDW | 0x2dd2c | 0x25 |
mciGetDeviceIDW | 0x30e40 | 0x26 |
mciGetDriverData | 0x3bc28 | 0x27 |
mciGetErrorStringA | 0x2e2a0 | 0x28 |
mciGetErrorStringW | 0x2ecc4 | 0x29 |
mciGetYieldProc | 0x29898 | 0x2a |
mciLoadCommandResource | 0x229b0 | 0x2b |
mciSendCommandA | 0x853c | 0x2c |
mciSendCommandW | 0xcc00 | 0x2d |
mciSendStringA | 0x28d90 | 0x2e |
mciSendStringW | 0x16548 | 0x2f |
mciSetDriverData | 0x3c910 | 0x30 |
mciSetYieldProc | 0x30648 | 0x31 |
midiConnect | 0x3363c | 0x32 |
midiDisconnect | 0x25cf8 | 0x33 |
midiInAddBuffer | 0x3a99c | 0x34 |
midiInClose | 0x31314 | 0x35 |
midiInGetDevCapsA | 0x32024 | 0x36 |
midiInGetDevCapsW | 0x1c7a0 | 0x37 |
midiInGetErrorTextA | 0xe864 | 0x38 |
midiInGetErrorTextW | 0x3a20c | 0x39 |
midiInGetID | 0x50b8 | 0x3a |
midiInGetNumDevs | 0x34ac | 0x3b |
midiInMessage | 0x2cf28 | 0x3c |
midiInOpen | 0x21550 | 0x3d |
midiInPrepareHeader | 0x246f0 | 0x3e |
midiInReset | 0x18964 | 0x3f |
midiInStart | 0x2abd8 | 0x40 |
midiInStop | 0x3f8d0 | 0x41 |
midiInUnprepareHeader | 0x38b6c | 0x42 |
midiOutCacheDrumPatches | 0x37cb0 | 0x43 |
midiOutCachePatches | 0x20d20 | 0x44 |
midiOutClose | 0x3b05c | 0x45 |
midiOutGetDevCapsA | 0x3800 | 0x46 |
midiOutGetDevCapsW | 0x235c | 0x47 |
midiOutGetErrorTextA | 0x26120 | 0x48 |
midiOutGetErrorTextW | 0xf05c | 0x49 |
midiOutGetID | 0x2c3f4 | 0x4a |
midiOutGetNumDevs | 0x2bb1c | 0x4b |
midiOutGetVolume | 0x14b84 | 0x4c |
midiOutLongMsg | 0xbd0c | 0x4d |
midiOutMessage | 0x208f8 | 0x4e |
midiOutOpen | 0x3b790 | 0x4f |
midiOutPrepareHeader | 0x1516c | 0x50 |
midiOutReset | 0x158cc | 0x51 |
midiOutSetVolume | 0x3f478 | 0x52 |
midiOutShortMsg | 0x71fc | 0x53 |
midiOutUnprepareHeader | 0x2c238 | 0x54 |
midiStreamClose | 0x3b220 | 0x55 |
midiStreamOpen | 0x220cc | 0x56 |
midiStreamOut | 0x152d0 | 0x57 |
midiStreamPause | 0x3706c | 0x58 |
midiStreamPosition | 0x3cb48 | 0x59 |
midiStreamProperty | 0x21914 | 0x5a |
midiStreamRestart | 0x2a110 | 0x5b |
midiStreamStop | 0x3e930 | 0x5c |
mixerClose | 0x1d760 | 0x5d |
mixerGetControlDetailsA | 0x3b398 | 0x5e |
mixerGetControlDetailsW | 0x1b6e4 | 0x5f |
mixerGetDevCapsA | 0x28510 | 0x60 |
mixerGetDevCapsW | 0x39a8c | 0x61 |
mixerGetID | 0x27c78 | 0x62 |
mixerGetLineControlsA | 0x1b870 | 0x63 |
mixerGetLineControlsW | 0x14c50 | 0x64 |
mixerGetLineInfoA | 0x4024c | 0x65 |
mixerGetLineInfoW | 0x3893c | 0x66 |
mixerGetNumDevs | 0x2cb94 | 0x67 |
mixerMessage | 0x3d9b0 | 0x68 |
mixerOpen | 0x1a8a4 | 0x69 |
mixerSetControlDetails | 0x1604 | 0x6a |
mmDrvInstall | 0x4fa0 | 0x6b |
mmGetCurrentTask | 0x35e80 | 0x6c |
mmTaskBlock | 0x30a0 | 0x6d |
mmTaskCreate | 0x3f038 | 0x6e |
mmTaskSignal | 0x1ef60 | 0x6f |
mmTaskYield | 0xc638 | 0x70 |
mmioAdvance | 0x2ee80 | 0x71 |
mmioAscend | 0x5190 | 0x72 |
mmioClose | 0x1e998 | 0x73 |
mmioCreateChunk | 0x260dc | 0x74 |
mmioDescend | 0x39708 | 0x75 |
mmioFlush | 0x40a64 | 0x76 |
mmioGetInfo | 0x1fe60 | 0x77 |
mmioInstallIOProcA | 0x3cff0 | 0x78 |
mmioInstallIOProcW | 0x3bac0 | 0x79 |
mmioOpenA | 0x115d4 | 0x7a |
mmioOpenW | 0xbaa4 | 0x7b |
mmioRead | 0x11994 | 0x7c |
mmioRenameA | 0x8c18 | 0x7d |
mmioRenameW | 0x39edc | 0x7e |
mmioSeek | 0x34de8 | 0x7f |
mmioSendMessage | 0x14268 | 0x80 |
mmioSetBuffer | 0x33d6c | 0x81 |
mmioSetInfo | 0xd6a4 | 0x82 |
mmioStringToFOURCCA | 0x2eae0 | 0x83 |
mmioStringToFOURCCW | 0x25fa0 | 0x84 |
mmioWrite | 0x1c654 | 0x85 |
mmsystemGetVersion | 0x35814 | 0x86 |
sndPlaySoundA | 0x29f1c | 0x87 |
sndPlaySoundW | 0x1b428 | 0x88 |
timeBeginPeriod | 0x1043c | 0x89 |
timeEndPeriod | 0xfc90 | 0x8a |
timeGetDevCaps | 0x17698 | 0x8b |
timeGetSystemTime | 0x21c88 | 0x8c |
timeGetTime | 0x7108 | 0x8d |
timeKillEvent | 0x1d81c | 0x8e |
timeSetEvent | 0x21db0 | 0x8f |
waveInAddBuffer | 0x349ac | 0x90 |
waveInClose | 0xcef8 | 0x91 |
waveInGetDevCapsA | 0x2e58 | 0x92 |
waveInGetDevCapsW | 0x209d8 | 0x93 |
waveInGetErrorTextA | 0x35a98 | 0x94 |
waveInGetErrorTextW | 0xee9c | 0x95 |
waveInGetID | 0x2bec8 | 0x96 |
waveInGetNumDevs | 0x3d4b0 | 0x97 |
waveInGetPosition | 0x268a8 | 0x98 |
waveInMessage | 0xb7f4 | 0x99 |
waveInOpen | 0x1e880 | 0x9a |
waveInPrepareHeader | 0x15be4 | 0x9b |
waveInReset | 0x3f794 | 0x9c |
waveInStart | 0x2a7c0 | 0x9d |
waveInStop | 0xb974 | 0x9e |
waveInUnprepareHeader | 0x220e0 | 0x9f |
waveOutBreakLoop | 0x3d068 | 0xa0 |
waveOutClose | 0x74dc | 0xa1 |
waveOutGetDevCapsA | 0x4c64 | 0xa2 |
waveOutGetDevCapsW | 0x32ba4 | 0xa3 |
waveOutGetErrorTextA | 0x20ca0 | 0xa4 |
waveOutGetErrorTextW | 0x1b1dc | 0xa5 |
waveOutGetID | 0x376e0 | 0xa6 |
waveOutGetNumDevs | 0x133b8 | 0xa7 |
waveOutGetPitch | 0x12324 | 0xa8 |
waveOutGetPlaybackRate | 0xa7c8 | 0xa9 |
waveOutGetPosition | 0x2624c | 0xaa |
waveOutGetVolume | 0xf0b8 | 0xab |
waveOutMessage | 0x1e4a4 | 0xac |
waveOutOpen | 0xda84 | 0xad |
waveOutPause | 0x2c6f0 | 0xae |
waveOutPrepareHeader | 0xecc8 | 0xaf |
waveOutReset | 0x4b34 | 0xb0 |
waveOutRestart | 0x84bc | 0xb1 |
waveOutSetPitch | 0x361d4 | 0xb2 |
waveOutSetPlaybackRate | 0xf85c | 0xb3 |
waveOutSetVolume | 0x2a768 | 0xb4 |
waveOutUnprepareHeader | 0x34064 | 0xb5 |
waveOutWrite | 0x1d4e4 | 0xb6 |
(by ordinal) | 0xff7c | 0x2 |
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|
c:\users\rdhj0cnfevzx\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-1560258661-3990802383-1811730007-1000\3d3578a85286f88c6cd9d151e4412949_03845cb8-7441-4a2f-8c0f-c90408af5778 | Dropped File | Stream |
clean
|
...
|