Static task
static1
Behavioral task
behavioral1
Sample
ac3dc78199bfaf2ed389c803b41e3ce7b7135c0e7cde7147462c3b4dc0f0c577.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ac3dc78199bfaf2ed389c803b41e3ce7b7135c0e7cde7147462c3b4dc0f0c577.exe
Resource
win10v2004-20220812-en
General
-
Target
ac3dc78199bfaf2ed389c803b41e3ce7b7135c0e7cde7147462c3b4dc0f0c577
-
Size
19KB
-
MD5
03c8dc7495d330a5e5e62e7150bf25ba
-
SHA1
483aa9af6542c21a8b4b7ca2774d97bf1f700950
-
SHA256
ac3dc78199bfaf2ed389c803b41e3ce7b7135c0e7cde7147462c3b4dc0f0c577
-
SHA512
5036b45b2d2196ec460441ebf6a932808b3c241417613a1038e7dac90cddaa0434e60d021a5894e5d193eff4bedb569b0a701621cb9375bf89e450fb108bab97
-
SSDEEP
384:549v3EyuvymGwbyShEwkwUqXLKnyYMepQH0PBGZui2eMwHbZ7wvVF4N09z3b71+o:5aCGww+7LJV4
Malware Config
Signatures
Files
-
ac3dc78199bfaf2ed389c803b41e3ce7b7135c0e7cde7147462c3b4dc0f0c577.exe windows x86
1c8913c1b0f1276e22a04a870ce57797
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_except_handler3
_stricmp
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsSetLoadImageNotifyRoutine
ProbeForRead
ExAllocatePoolWithTag
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
ZwQueryInformationProcess
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
PsTerminateSystemThread
ProbeForWrite
MmIsAddressValid
ExFreePool
ExGetPreviousMode
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zeata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
vfata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
zbata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
vaata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 382B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ