Static task
static1
Behavioral task
behavioral1
Sample
501f77677f2e8e243b0e5918f2bd609fc08d245e488c6f984b29b41e82783389.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
501f77677f2e8e243b0e5918f2bd609fc08d245e488c6f984b29b41e82783389.exe
Resource
win10v2004-20221111-en
General
-
Target
501f77677f2e8e243b0e5918f2bd609fc08d245e488c6f984b29b41e82783389
-
Size
43KB
-
MD5
2157c34fdc647f883bb21eae5e9df140
-
SHA1
3a2049f258d0f612c02810fabb2e5b6791996aac
-
SHA256
501f77677f2e8e243b0e5918f2bd609fc08d245e488c6f984b29b41e82783389
-
SHA512
8833ac37a18d85efa86c729813eee32473579aaff8c2e60dcca26566ac0b05a008c87ea542ed9cc1472ccd2feea5c2259ff4ec7929e8b1f7bd222d841368dc2b
-
SSDEEP
768:9B8MAAeOMJ1L38nt3PxYeNTi00m/heuysgQBgRrg:zXAfOMTL3A3pi0euysgRR
Malware Config
Signatures
Files
-
501f77677f2e8e243b0e5918f2bd609fc08d245e488c6f984b29b41e82783389.exe windows x86
21182c2565191326cf3d7ea744a808c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeTickCount
KeBugCheckEx
ObfDereferenceObject
ExRegisterCallback
ExCreateCallback
RtlInitUnicodeString
ExUnregisterCallback
IoFreeWorkItem
KeCancelTimer
IoQueueWorkItem
IoAllocateWorkItem
KeSetTimerEx
KeWaitForSingleObject
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
ZwEnumerateValueKey
ExFreePoolWithTag
ZwQueryKey
IoBuildDeviceIoControlRequest
_allshr
IoAttachDeviceToDeviceStack
IoDeleteDevice
IoCreateDevice
KeInitializeDpc
KeInitializeTimer
ZwQueryValueKey
ZwClose
ZwOpenKey
RtlCopyUnicodeString
IoFreeMdl
MmFreePagesFromMdl
IoAllocateMdl
KeSetEvent
MmAllocatePagesForMdl
KeInsertQueueDpc
KeClearEvent
KeSetTargetProcessorDpc
KeQueryActiveProcessors
IoWMIRegistrationControl
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
MmAllocateContiguousMemorySpecifyCache
MmGetPhysicalAddress
MmFreeContiguousMemory
ExAllocatePoolWithTag
DbgPrint
IoDetachDevice
DbgBreakPoint
hal
ExAcquireFastMutex
HalGetBusDataByOffset
HalSetBusDataByOffset
KeGetCurrentIrql
ExReleaseFastMutex
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 395B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ