Static task
static1
Behavioral task
behavioral1
Sample
4748d22a5cb156011fea9f449c573bbad649d896d0ce519eba99b5ea1918073f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4748d22a5cb156011fea9f449c573bbad649d896d0ce519eba99b5ea1918073f.exe
Resource
win10v2004-20220812-en
General
-
Target
4748d22a5cb156011fea9f449c573bbad649d896d0ce519eba99b5ea1918073f
-
Size
822KB
-
MD5
2136d26817322840a7634b717d30db30
-
SHA1
afb80fd210a0134a3941030312a3c51774bdb85b
-
SHA256
4748d22a5cb156011fea9f449c573bbad649d896d0ce519eba99b5ea1918073f
-
SHA512
e4aefe937e7dcde586a7a7a093c8733b5e0b5b47c963743dc775424f599dd7442b0525dbb61068aaab1366538d359dc2f9ff38d299067547383e2104edbd6921
-
SSDEEP
24576:W5Nie7jQY9vLWDa0qywlLsZByUf2yu061rQ21wa8V:W5Nie7j9vK+0qZYWa2yr6ppq5
Malware Config
Signatures
Files
-
4748d22a5cb156011fea9f449c573bbad649d896d0ce519eba99b5ea1918073f.exe windows x86
6679c106700397b6ac6a58fc417fe539
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
sprintf
ZwQuerySystemInformation
ExFreePoolWithTag
RtlLargeIntegerArithmeticShift
RtlLargeIntegerAdd
RtlMoveMemory
RtlUnwind
ZwFreeVirtualMemory
FsRtlCurrentBatchOplock
ZwEnumerateKey
ZwQueryValueKey
RtlDeleteAce
CcCopyRead
RtlSizeHeap
RtlValidSid
MmFreePagesFromMdl
FsRtlRemoveLargeMcbEntry
FsRtlIsNtstatusExpected
NtQuerySecurityObject
IoWriteTransferCount
IoCreateDevice
IoGetAttachedDevice
IoQueryVolumeInformation
KeInitializeTimerEx
IoDeviceHandlerObjectType
ZwSetInformationProcess
ExInterlockedExtendZone
NtAllocateLocallyUniqueId
PsGetVersion
FsRtlDeleteTunnelCache
IoAllocateDriverObjectExtension
NtSetInformationFile
RtlAppendUnicodeStringToString
IoCreateSymbolicLink
InterlockedDecrement
ExRaiseHardError
RtlClearAllBits
ExAllocatePool
IoCheckFunctionAccess
KeRemoveEntryDeviceQueue
RtlInitAnsiString
NtOpenProcess
ExAcquireSharedWaitForExclusive
RtlLookupAtomInAtomTable
CcGetFlushedValidData
KeRemoveQueue
IoReportTargetDeviceChange
wcsncmp
ZwSetEvent
RtlInsertElementGenericTable
MmProbeAndLockSelectedPages
KeResetEvent
FsRtlUninitializeOplock
RtlCopySid
ExfInterlockedInsertHeadList
IoDeleteDriver
RtlSubtreePredecessor
KeSynchronizeExecution
MmFreeContiguousMemory
SeUnlockSubjectContext
FsRtlOplockIsFastIoPossible
FsRtlLookupMcbEntry
NtRequestWaitReplyPort
strcat
ZwInitiatePowerAction
_wcsupr
KePulseEvent
IoDeleteDevice
RtlPinAtomInAtomTable
ZwCloseObjectAuditAlarm
IoRequestDeviceEject
RtlInitializeGenericTable
isspace
PsRestoreImpersonation
KeQuerySystemTime
SeUnregisterLogonSessionTerminatedRoutine
MmPageEntireDriver
SeQueryAuthenticationIdToken
RtlFreeRangeList
FsRtlLookupLastLargeMcbEntry
ObReferenceObjectByPointer
Sections
.text Size: 385KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 349B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 419KB - Virtual size: 418KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ