Static task
static1
Behavioral task
behavioral1
Sample
928c06b2dddbeeb9a2fb4c7889280f953030f6101dd247bf21a208eaf37f34fa.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
928c06b2dddbeeb9a2fb4c7889280f953030f6101dd247bf21a208eaf37f34fa.exe
Resource
win10v2004-20221111-en
General
-
Target
928c06b2dddbeeb9a2fb4c7889280f953030f6101dd247bf21a208eaf37f34fa
-
Size
18KB
-
MD5
692e17509bd50c5d67599a336ed74256
-
SHA1
95ef3906e3d654a61ca26e00adbfbe2017bfc08f
-
SHA256
928c06b2dddbeeb9a2fb4c7889280f953030f6101dd247bf21a208eaf37f34fa
-
SHA512
5d3ef4a58650ad2550e3239f5f4db7e8b6fb4708eed965efae79c82d8500379b173f9db1d0e66d458a5ea3a2efe0d7782cf836b1809686609590422af3310bae
-
SSDEEP
384:E9v3EyuvymGtyShEwkwUqXLKnyYMepQH0PBGZui2eMwHbZ7wvVF4N09z3b7F+nox:mCGy+D/Pi
Malware Config
Signatures
Files
-
928c06b2dddbeeb9a2fb4c7889280f953030f6101dd247bf21a208eaf37f34fa.exe windows x86
f951db6eb9c20f16a485f59d17220c34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_except_handler3
_stricmp
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ExFreePool
ProbeForRead
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
ZwQueryInformationProcess
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
PsTerminateSystemThread
ProbeForWrite
MmIsAddressValid
ExAllocatePoolWithTag
ExGetPreviousMode
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zcata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
vcata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 382B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ