Static task
static1
Behavioral task
behavioral1
Sample
cb2808803277af1dcd30986ade0b358406747ae192f760cb4b0eacb2099c4116.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cb2808803277af1dcd30986ade0b358406747ae192f760cb4b0eacb2099c4116.exe
Resource
win10v2004-20220812-en
General
-
Target
cb2808803277af1dcd30986ade0b358406747ae192f760cb4b0eacb2099c4116
-
Size
15KB
-
MD5
5b2bae0ad9fe9d03419df3f170f11b5a
-
SHA1
94816327826f1ac2c0fc7e71cb972bfd450979d5
-
SHA256
cb2808803277af1dcd30986ade0b358406747ae192f760cb4b0eacb2099c4116
-
SHA512
a5fa18cab191a897dda3e6c13f7451d722ae31e752b5758adb9e7555e71d572ff8f9fc5f8059d387350fb2039fcc5dbf184cf739b875e9261deba0f99a3641bc
-
SSDEEP
384:v+GFbOHu9wonHH1COEFMSix0gUAEan7aXCocu5AXE/xWJ+SGOcg3rprg/FdA9slk:v+rHaB8OEFFe
Malware Config
Signatures
Files
-
cb2808803277af1dcd30986ade0b358406747ae192f760cb4b0eacb2099c4116.exe windows x86
b3d7176032cc7d764c4ef684bcc16d69
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
_stricmp
_strupr
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
ExFreePool
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
PsTerminateSystemThread
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 912B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 358B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ