Static task
static1
Behavioral task
behavioral1
Sample
eaca24c203cbad2f029da7b86e0ed332c08387ba8e867b8c264c18e4ac5c6269.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eaca24c203cbad2f029da7b86e0ed332c08387ba8e867b8c264c18e4ac5c6269.exe
Resource
win10v2004-20220812-en
General
-
Target
eaca24c203cbad2f029da7b86e0ed332c08387ba8e867b8c264c18e4ac5c6269
-
Size
92KB
-
MD5
0a390dba2a0ec4078828ab56c0cfae70
-
SHA1
0476445e4d2bfdddf43693a16b66e7eef591ac1d
-
SHA256
eaca24c203cbad2f029da7b86e0ed332c08387ba8e867b8c264c18e4ac5c6269
-
SHA512
3b4abe551b1c93f00e3dc84e3c552521cb5a7765551b67a6a0678940cab46b72669d7225364ac12a7f0936428095110eefc4f1fcf9056418c221c11f57fe3c93
-
SSDEEP
768:P5Qktglls2bmcLgXP9W1ii1dP3FBjMqGugGQEiSyC8XU+m4RMFUT9DtPYpYtl:mbof9W1ZdPkqQGQELyC8kgRAW95/
Malware Config
Signatures
Files
-
eaca24c203cbad2f029da7b86e0ed332c08387ba8e867b8c264c18e4ac5c6269.exe windows x86
34462307731002b6f46ac0e3f3c74c88
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwQuerySystemInformation
RtlEqualUnicodeString
ZwQueryObject
ZwCreateFile
ZwReadFile
ZwClose
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
RtlInitUnicodeString
swprintf
IofCallDriver
IofCompleteRequest
KeDetachProcess
RtlAppendUnicodeToString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
KeAttachProcess
ObfDereferenceObject
PsLookupProcessByProcessId
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
DbgPrint
KeWaitForSingleObject
KeInitializeEvent
IoBuildAsynchronousFsdRequest
RtlLookupElementGenericTable
RtlInsertElementGenericTable
_allmul
PsTerminateSystemThread
MmMapLockedPagesSpecifyCache
ExfInterlockedRemoveHeadList
KeSetPriorityThread
KeGetCurrentThread
RtlInitializeGenericTable
NtBuildNumber
_alldiv
ZwSetValueKey
ZwCreateKey
strncmp
IoGetCurrentProcess
toupper
ZwFsControlFile
KeTickCount
RtlAppendUnicodeStringToString
PsSetLoadImageNotifyRoutine
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
MmUnmapLockedPages
MmMapLockedPages
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
RtlEnumerateGenericTableWithoutSplaying
ExFreePool
RtlVolumeDeviceToDosName
IoDeleteDevice
IoRegisterBootDriverReinitialization
PsGetCurrentProcessId
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
RtlDeleteElementGenericTable
InterlockedExchange
RtlCompareMemory
ExfInterlockedInsertTailList
PsGetCurrentThreadId
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoAttachDeviceToDeviceStack
KeNumberProcessors
InterlockedDecrement
InterlockedIncrement
IoDetachDevice
IoWMIRegistrationControl
PoCallDriver
PoStartNextPowerIrp
KeQuerySystemTime
InterlockedCompareExchange
wcsncpy
IoBuildDeviceIoControlRequest
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeBugCheck
ExRaiseHardError
_allshl
_aullshr
_aulldiv
_aullrem
KeQueryTimeIncrement
_except_handler3
hal
KfAcquireSpinLock
KeQueryPerformanceCounter
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 480B - Virtual size: 456B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ