Static task
static1
Behavioral task
behavioral1
Sample
e2e64ffab74adc138162c13902347e61612c721202666834abd02adac703d6e9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e2e64ffab74adc138162c13902347e61612c721202666834abd02adac703d6e9.exe
Resource
win10v2004-20220812-en
General
-
Target
e2e64ffab74adc138162c13902347e61612c721202666834abd02adac703d6e9
-
Size
6KB
-
MD5
4488710803f2c17ec8818c1188d6cbb6
-
SHA1
7c3c0a9c2640ba324bfcdff6fe5d6daded86af92
-
SHA256
e2e64ffab74adc138162c13902347e61612c721202666834abd02adac703d6e9
-
SHA512
29c9f0f2c458c06c50d8196f57a638b3cc2977511ad2f2ad8496b8b19d33e1df7f08cef3f5e95232fbef5f40fef5eb6b4accf0d5729ff43c653d52830116aa9e
-
SSDEEP
192:vmwElajKftFNCsuhre0HPksKUm03XSTIvoW0YbImz:vmw1jKHNCsuZe0PksKR03XS0jVz
Malware Config
Signatures
Files
-
e2e64ffab74adc138162c13902347e61612c721202666834abd02adac703d6e9.exe windows x86
bd4f4587ca581be542ec2e0ddccbf83e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
KeGetCurrentThread
RtlAssert
DbgPrint
ExAllocatePoolWithTag
KeInsertQueueApc
RtlInitUnicodeString
ObfReferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
_except_handler3
ObfDereferenceObject
MmIsAddressValid
hal
KfLowerIrql
KeGetCurrentIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ