Static task
static1
Behavioral task
behavioral1
Sample
dc5457183916a022b17d660007402db6504ed5087e5d0ebeca29409e977b72dd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dc5457183916a022b17d660007402db6504ed5087e5d0ebeca29409e977b72dd.exe
Resource
win10v2004-20220901-en
General
-
Target
dc5457183916a022b17d660007402db6504ed5087e5d0ebeca29409e977b72dd
-
Size
64KB
-
MD5
4643418a7c80dd2c11024d32d3a81fbd
-
SHA1
a89af1fe86089c1b80893ec69e5bb3761f47717a
-
SHA256
dc5457183916a022b17d660007402db6504ed5087e5d0ebeca29409e977b72dd
-
SHA512
c6ee9ec94edb91c178c8f7ab92574cf58cfb957a25e763695c5c94b4dfca580840c31551fad3e480e68cac556bb2163d5a88106c21a688a13d601e7ac8cfabf2
-
SSDEEP
1536:/RJ/O/28+XO8jRSsjd+kvQIvTjtyfGuUD9oI1/:/2/a1Bjd+cQ2TjtyEoI
Malware Config
Signatures
Files
-
dc5457183916a022b17d660007402db6504ed5087e5d0ebeca29409e977b72dd.exe windows x86
8954ed866537d623515546e4cc2467fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
READ_REGISTER_UCHAR
ZwOpenKey
RtlInitUnicodeString
KeQuerySystemTime
KeSaveFloatingPointState
KeInitializeSpinLock
IoAllocateWorkItem
IoFreeWorkItem
IoQueueWorkItem
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
KeTickCount
KeBugCheckEx
ExAllocatePoolWithTag
MmMapLockedPagesSpecifyCache
ExFreePool
InterlockedDecrement
InterlockedIncrement
RtlRaiseException
hal
KfAcquireSpinLock
KfReleaseSpinLock
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 964B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 234B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.PAGE Size: 256B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE