Static task
static1
Behavioral task
behavioral1
Sample
f32339b15f6f5f3abdc745460ca6b3021a45e81704fef802eaca83a0bb0d386a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f32339b15f6f5f3abdc745460ca6b3021a45e81704fef802eaca83a0bb0d386a.exe
Resource
win10v2004-20220901-en
General
-
Target
f32339b15f6f5f3abdc745460ca6b3021a45e81704fef802eaca83a0bb0d386a
-
Size
53KB
-
MD5
68e8341d6ef02eb03500decc9d11a75a
-
SHA1
982afa52d15ed5936160512f3cd0931c3bf4b4f2
-
SHA256
f32339b15f6f5f3abdc745460ca6b3021a45e81704fef802eaca83a0bb0d386a
-
SHA512
ec71e26658e7c8b83349308e232029bd76ec19e80f0a3ac411a76105ea3f70acbc4ea10b704fb79acdda2b5cea0ba7259e6d8d3763db8771f0565c15489db301
-
SSDEEP
768:+5r4Xjz9+yyKUIMAEAYS6POxzupqTNjjBtq3niic1BGc5WzJB:+5r8+AYSJZtJBozJ
Malware Config
Signatures
Files
-
f32339b15f6f5f3abdc745460ca6b3021a45e81704fef802eaca83a0bb0d386a.exe windows x86
aafb43bdf1c26b5eed8ba8a6b1dc65de
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoStartPacket
IoAcquireRemoveLockEx
memmove
ObfDereferenceObject
IoGetAttachedDeviceReference
ExAllocatePoolWithTag
WRITE_REGISTER_UCHAR
READ_REGISTER_UCHAR
MmMapIoSpace
KeInsertQueueDpc
KeSetTimer
KeSynchronizeExecution
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
memcpy
IoAllocateController
IoDeleteController
MmUnmapIoSpace
KeDelayExecutionThread
RtlQueryRegistryValues
RtlAppendUnicodeToString
RtlInitUnicodeString
memset
KeInitializeTimer
IoCreateController
IoInvalidateDeviceState
KeQueryTimeIncrement
KeTickCount
IoFreeWorkItem
PoStartNextPowerIrp
PoSetPowerState
KdEnableDebugger
KdChangeOption
KeBugCheckEx
ZwSetValueKey
ZwClose
IofCallDriver
_allmul
IoOpenDeviceRegistryKey
DbgBreakPointWithStatus
KdDebuggerEnabled
KdDebuggerNotPresent
IoConnectInterrupt
KeInitializeDpc
KeRemoveQueueDpc
RtlFreeUnicodeString
IoSetDeviceInterfaceState
IoDisconnectInterrupt
KeSetTimerEx
IoFreeIrp
_wcsupr
_alldiv
IoAllocateIrp
MmLockPagableDataSection
IoUnregisterPlugPlayNotification
IoQueueWorkItem
IoAllocateWorkItem
KeInitializeTimerEx
IoRegisterPlugPlayNotification
IoSetStartIoAttributes
IoInitializeRemoveLockEx
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeSetEvent
IoQueryDeviceDescription
IoRegisterDeviceInterface
IoDetachDevice
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoReleaseRemoveLockAndWaitEx
IoWMIRegistrationControl
PoCallDriver
RtlUnwind
KeWaitForSingleObject
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
KeCancelTimer
KefAcquireSpinLockAtDpcLevel
ExFreePoolWithTag
KefReleaseSpinLockFromDpcLevel
IoFreeController
IoStartNextPacket
IoReleaseRemoveLockEx
ZwOpenKey
IofCompleteRequest
hal
KfAcquireSpinLock
READ_PORT_UCHAR
KfRaiseIrql
KfLowerIrql
WRITE_PORT_UCHAR
KfReleaseSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEMOUC Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ