Static task
static1
Behavioral task
behavioral1
Sample
4bb603d12c878898aa01f0b0f4eef3c2327a4708133bdbf29c6a738fc088eda2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4bb603d12c878898aa01f0b0f4eef3c2327a4708133bdbf29c6a738fc088eda2.exe
Resource
win10v2004-20220812-en
General
-
Target
4bb603d12c878898aa01f0b0f4eef3c2327a4708133bdbf29c6a738fc088eda2
-
Size
24KB
-
MD5
9211fcb475acad942d415b95c208068d
-
SHA1
85997c52fe4a11a38b255a3718f96e2b925193bb
-
SHA256
4bb603d12c878898aa01f0b0f4eef3c2327a4708133bdbf29c6a738fc088eda2
-
SHA512
94e22b606a9d7f77c71df9a5fa9b3fd6767915a19cae7a907038c13b8c26122da939ea52155af27aa3ab42272679ceed35a8223b05273d8f6e72a5af642ebdd2
-
SSDEEP
384:hCQ+7UQnTkR8SPLEiWiF3vF/sEUSNvE9u5LqM1C6uhwqOnmB6zTwo/6UbhX8Ptn:hD+7DnTG84LTWijUSNvECr1CNGnmBOb
Malware Config
Signatures
Files
-
4bb603d12c878898aa01f0b0f4eef3c2327a4708133bdbf29c6a738fc088eda2.exe windows x86
a2d961f1d0c77a919382efbf90a167b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoOpenDeviceRegistryKey
IoReleaseRemoveLockEx
IofCompleteRequest
IoReleaseCancelSpinLock
KeSetEvent
KeWaitForSingleObject
KeInitializeEvent
memmove
RtlCopyUnicodeString
RtlQueryRegistryValues
RtlAppendUnicodeToString
ObfDereferenceObject
IoRegisterPlugPlayNotification
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoBuildDeviceIoControlRequest
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoUnregisterPlugPlayNotification
IoFreeWorkItem
DbgPrint
IoQueueWorkItem
IoAcquireRemoveLockEx
IoAllocateWorkItem
PoCallDriver
PoStartNextPowerIrp
ZwClose
IoFreeIrp
PoRequestPowerIrp
IoAllocateIrp
SeSinglePrivilegeCheck
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PoSetSystemState
IoDeleteDevice
RtlFreeUnicodeString
KeInitializeSpinLock
IoInitializeRemoveLockEx
IoCreateDevice
IoSetDeviceInterfaceState
IoWMIRegistrationControl
IoCancelIrp
ZwSetValueKey
RtlWriteRegistryValue
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoRegisterDeviceInterface
ZwOpenKey
IoAttachDeviceToDeviceStack
IoRegisterDriverReinitialization
KeTickCount
KeBugCheckEx
VerSetConditionMask
RtlVerifyVersionInfo
ZwPowerInformation
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwQueryValueKey
ExFreePoolWithTag
PoSetPowerState
IofCallDriver
hal
KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 433B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 896B - Virtual size: 892B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ