Static task
static1
Behavioral task
behavioral1
Sample
a66d9efb9a17f165117dbaf976b5d2b8bb462c1bcb3db080f2780fa5086d3511.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a66d9efb9a17f165117dbaf976b5d2b8bb462c1bcb3db080f2780fa5086d3511.exe
Resource
win10v2004-20220901-en
General
-
Target
a66d9efb9a17f165117dbaf976b5d2b8bb462c1bcb3db080f2780fa5086d3511
-
Size
131KB
-
MD5
6f85baa7216fa05f9aac6358855be716
-
SHA1
cef82e44e46efb5ac5d4545e32167310e834b740
-
SHA256
a66d9efb9a17f165117dbaf976b5d2b8bb462c1bcb3db080f2780fa5086d3511
-
SHA512
e790b9e1641bf21f0670d593ad8adb923d61ed767c0bd6a4d7a21484b3256ca9d80421fd6f172b68d1b9c69fce94d57aba61f2b6f4c0169e7656152393e72824
-
SSDEEP
3072:vV8ME7FwEUKVr/CydpgUppl/cOHEbvwhN5sdioJzqhtSg:vVjE7FwcNdGA3bHEQ/oJzqhs
Malware Config
Signatures
Files
-
a66d9efb9a17f165117dbaf976b5d2b8bb462c1bcb3db080f2780fa5086d3511.exe windows x86
4444223b24cd39f5854c2af57ed54688
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
RtlInitUnicodeString
KeWaitForSingleObject
KeInitializeEvent
KeSetEvent
ZwClose
IofCompleteRequest
ExFreePoolWithTag
IoCreateDevice
ZwQueryValueKey
PoCallDriver
IoFreeIrp
PoStartNextPowerIrp
IoAttachDeviceToDeviceStack
RtlFreeUnicodeString
MmMapLockedPagesSpecifyCache
KeInitializeDpc
ZwOpenKey
RtlQueryRegistryValues
RtlCopyUnicodeString
IoOpenDeviceRegistryKey
IoFreeMdl
KeCancelTimer
ExFreePool
IoQueueWorkItem
KeInitializeTimer
IoAllocateWorkItem
IoBuildDeviceIoControlRequest
IoWMIRegistrationControl
KeDelayExecutionThread
KeClearEvent
ObReferenceObjectByHandle
KeSetTimer
IoSetDeviceInterfaceState
PoSetPowerState
IoRegisterDeviceInterface
ZwSetValueKey
MmGetSystemRoutineAddress
KeReleaseSpinLockFromDpcLevel
PoRequestPowerIrp
KeAcquireSpinLockAtDpcLevel
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
IoReleaseCancelSpinLock
PsTerminateSystemThread
RtlAnsiStringToUnicodeString
IoWMIWriteEvent
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoBuildSynchronousFsdRequest
IoDeleteSymbolicLink
MmUnmapIoSpace
_vsnwprintf
IoInitializeRemoveLockEx
KeResetEvent
RtlAppendUnicodeToString
ObfReferenceObject
MmMapIoSpace
IoReleaseRemoveLockEx
KeQueryTimeIncrement
KeReleaseMutex
KeInitializeMutex
IoCreateSymbolicLink
IoReleaseRemoveLockAndWaitEx
_vsnprintf
RtlIntegerToUnicodeString
IoGetAttachedDeviceReference
KeSetTimerEx
ExInitializeNPagedLookasideList
IoAcquireCancelSpinLock
KeWaitForMultipleObjects
IoDisconnectInterrupt
IoConnectInterrupt
ZwCreateFile
RtlWriteRegistryValue
ZwQuerySystemInformation
MmProbeAndLockPages
IoInvalidateDeviceRelations
IoGetDmaAdapter
MmUnlockPages
KeSetPriorityThread
KeRemoveQueueDpc
IoGetDeviceObjectPointer
ExAllocatePoolWithTag
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 716B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ