Static task
static1
Behavioral task
behavioral1
Sample
57c06e3e170dbfc6d80b1ccf840cf04ff2ba1e58c7f7569ee5a4a7e9bd4aab07.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
57c06e3e170dbfc6d80b1ccf840cf04ff2ba1e58c7f7569ee5a4a7e9bd4aab07.exe
Resource
win10v2004-20221111-en
General
-
Target
57c06e3e170dbfc6d80b1ccf840cf04ff2ba1e58c7f7569ee5a4a7e9bd4aab07
-
Size
3KB
-
MD5
5aa0c7cd993cb67e6f0a6a6eee926800
-
SHA1
4ecbad04c0c41532831464511173a57e355c060b
-
SHA256
57c06e3e170dbfc6d80b1ccf840cf04ff2ba1e58c7f7569ee5a4a7e9bd4aab07
-
SHA512
b8fbd8d64e17976ded9ed1af5daa17ffc823c2e692c4de7b14317f64d15e7e1164f3e751cd3e7365436f6949f6a84741e71678865a22c342118c781ee8c18f8a
Malware Config
Signatures
Files
-
57c06e3e170dbfc6d80b1ccf840cf04ff2ba1e58c7f7569ee5a4a7e9bd4aab07.exe windows x86
f457c2376072746bcb93f8ee1411652a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoFreeMdl
MmUnmapLockedPages
ZwTerminateProcess
InterlockedExchange
ZwOpenProcess
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoGetCurrentProcess
ObReferenceObjectByHandle
PsLookupProcessByProcessId
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 128B - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 512B - Virtual size: 393B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 896B - Virtual size: 852B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 138B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ