Static task
static1
Behavioral task
behavioral1
Sample
c5b5464b56fa192f16e1655db3c3cd58f48d3b59d40345b0b11c3b9bc2b2b017.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c5b5464b56fa192f16e1655db3c3cd58f48d3b59d40345b0b11c3b9bc2b2b017.exe
Resource
win10v2004-20220901-en
General
-
Target
c5b5464b56fa192f16e1655db3c3cd58f48d3b59d40345b0b11c3b9bc2b2b017
-
Size
53KB
-
MD5
a165d00543ac86d5555a6d66beda0830
-
SHA1
1d30d8c1e438bf9622522d7a0a5ecfba6a155536
-
SHA256
c5b5464b56fa192f16e1655db3c3cd58f48d3b59d40345b0b11c3b9bc2b2b017
-
SHA512
6b88f587716e3d36ca00d965d96098e68a3295128c3420070754aea0fb3cac0bbbee7f9c965380420d75ff8691b980131f099ba9de46348d0d77602452c6fb20
-
SSDEEP
768:KS3eL7P5ODF3jvHRmmxwuFLEGjurB/SLIyKNoukC6fiDKYnIWmla:KS3eP5y3rx3FLEJtSE3gC6fHzdl
Malware Config
Signatures
Files
-
c5b5464b56fa192f16e1655db3c3cd58f48d3b59d40345b0b11c3b9bc2b2b017.exe windows x86
282edf89fde9193cc476b0c83d9ce6f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KefReleaseSpinLockFromDpcLevel
MmGetSystemRoutineAddress
RtlInitUnicodeString
DbgPrint
ZwOpenProcess
ObOpenObjectByPointer
PsProcessType
ZwClose
ZwWriteFile
ZwCreateFile
ZwDeleteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePool
ZwQueryInformationFile
RtlCompareString
RtlInitString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
KeServiceDescriptorTable
PsGetVersion
memset
KefAcquireSpinLockAtDpcLevel
RtlCopyUnicodeString
RtlCompareUnicodeString
PsLookupProcessByProcessId
ZwQuerySystemInformation
PsTerminateSystemThread
KeInsertQueueApc
KeInitializeApc
MmIsAddressValid
IoThreadToProcess
PsLookupThreadByThreadId
ZwSetValueKey
ZwCreateKey
ZwDeleteKey
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
IoFreeMdl
MmUnmapLockedPages
IoCheckShareAccess
RtlCompareMemory
IoDeleteDevice
PsCreateSystemThread
_allmul
RtlFreeUnicodeString
KeDelayExecutionThread
hal
KeRaiseIrqlToDpcLevel
KfLowerIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ