Static task
static1
Behavioral task
behavioral1
Sample
41d41d224ff5249138b2e28e7bc472a524d11f515e111496cc42e0d02a085d6d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
41d41d224ff5249138b2e28e7bc472a524d11f515e111496cc42e0d02a085d6d.exe
Resource
win10v2004-20220812-en
General
-
Target
41d41d224ff5249138b2e28e7bc472a524d11f515e111496cc42e0d02a085d6d
-
Size
66KB
-
MD5
45bbe3094df7f9f7c6dd66441e46187f
-
SHA1
a57618c9b504bad15122bd130ad453a0a8d2a905
-
SHA256
41d41d224ff5249138b2e28e7bc472a524d11f515e111496cc42e0d02a085d6d
-
SHA512
5c0529189f1a3857bce3ba3f68fddffaa6e597e779f6eefcb1f2487f0e043b22819490bc8334e1c302ab13ec477ebbf9eb11a4bd0deb5b1837cd40daa00d0a3e
-
SSDEEP
1536:4SUwhKwvJSkz+QBulqa58bifiRaD/qelP+k2dhW:lU0KaIkqsuGkA54dN
Malware Config
Signatures
Files
-
41d41d224ff5249138b2e28e7bc472a524d11f515e111496cc42e0d02a085d6d.exe windows x86
90f10b997ac9a563726bef4ac993bcd9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
DbgBreakPoint
KeInitializeSpinLock
ExAllocatePoolWithTag
IofCompleteRequest
RtlQueryRegistryValues
MmMapLockedPages
DbgPrint
RtlInitUnicodeString
IoCreateDevice
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
IoDeleteDevice
IoAllocateMdl
IoFreeMdl
ExFreePool
IoBuildPartialMdl
hal
KfAcquireSpinLock
KfReleaseSpinLock
ndis.sys
NdisAllocatePacket
NdisAllocatePacketPool
NdisOpenAdapter
NdisRegisterProtocol
NdisCloseAdapter
NdisDeregisterProtocol
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 32B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 736B - Virtual size: 726B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 352B - Virtual size: 350B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ