Static task
static1
Behavioral task
behavioral1
Sample
c539fce053dd75a4c7676579d6c154b6aebe922051d0e76fe7b27836bbf93725.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c539fce053dd75a4c7676579d6c154b6aebe922051d0e76fe7b27836bbf93725.exe
Resource
win10v2004-20220812-en
General
-
Target
c539fce053dd75a4c7676579d6c154b6aebe922051d0e76fe7b27836bbf93725
-
Size
159KB
-
MD5
4eb9f36e0a0b20f19d3ba9322b986df8
-
SHA1
a851a69590e44b0276a9b3d242a7b5594b81e436
-
SHA256
c539fce053dd75a4c7676579d6c154b6aebe922051d0e76fe7b27836bbf93725
-
SHA512
00ba94248ecb379e76e38f1092a8178ee2a7f12c94c3e34114d2c0bd66cabd1cb62c728094415e1d5cd3b9abdc15610a7e89529c12397e7c5aefebd32d15c3c3
-
SSDEEP
3072:LdCV2PxGjwcNg4T6WFY69NrdlQzXVPkD6c2FfL26HQnZ3gXk23s5Pa+jB3dEx:0VysjLnswL2FfL3yJaU3
Malware Config
Signatures
Files
-
c539fce053dd75a4c7676579d6c154b6aebe922051d0e76fe7b27836bbf93725.exe windows x86
e037ca3d56e3fa625baccb53e84e8148
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_alldiv
SeDeassignSecurity
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
DbgPrint
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlOemStringToUnicodeString
RtlInitString
MmMapLockedPagesSpecifyCache
RtlAppendStringToString
RtlInitAnsiString
strchr
strncpy
KeCancelTimer
ZwClose
ZwCancelTimer
ZwSetTimer
ZwCreateTimer
_aulldiv
_allmul
IofCompleteRequest
IofCallDriver
IoBuildDeviceIoControlRequest
ObfReferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
KeSetTimer
KeInitializeDpc
KeInitializeTimer
IoDeleteDevice
KeClearEvent
ExDeleteResourceLite
IoFreeIrp
IoGetRelatedDeviceObject
ProbeForWrite
_except_handler3
RtlCopyUnicodeString
DbgBreakPoint
ZwCreateKey
memchr
ZwReadFile
ZwQueryInformationFile
RtlFreeUnicodeString
ZwCreateFile
IoRemoveShareAccess
SeAssignSecurity
RtlExtendedLargeIntegerDivide
IoCheckShareAccess
SeAccessCheck
ObReferenceObjectByHandle
NtWaitForSingleObject
ZwDeviceIoControlFile
ZwCreateEvent
wcslen
ExfInterlockedPushEntryList
ExRaiseAccessViolation
MmUserProbeAddress
IoFileObjectType
PsGetCurrentThread
ExQueueWorkItem
KeInsertQueueDpc
IoAllocateIrp
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
RtlExtendedMagicDivide
MmBuildMdlForNonPagedPool
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
swprintf
sprintf
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlMapGenericMask
IoGetFileObjectGenericMapping
SeSetSecurityDescriptorInfo
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
IoCreateDevice
RtlAppendUnicodeToString
ZwOpenKey
ZwQueryValueKey
memmove
IoBuildPartialMdl
MmUnmapLockedPages
KeDelayExecutionThread
MmLockPagableDataSection
KeTickCount
KeBugCheckEx
IoCancelIrp
IoAllocateMdl
ExfInterlockedInsertHeadList
PsGetCurrentProcess
KeAttachProcess
KeDetachProcess
ExfInterlockedInsertTailList
ObfDereferenceObject
IoFreeMdl
KeWaitForSingleObject
KeResetEvent
KeSetEvent
KeInitializeSpinLock
ExSystemTimeToLocalTime
KeInitializeEvent
ExInitializeResourceLite
strrchr
RtlCompareMemory
KeQuerySystemTime
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
strncmp
ExAllocatePoolWithTag
IoSetShareAccess
ExFreePoolWithTag
hal
KfReleaseSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
tdi.sys
TdiRegisterNetAddress
TdiProviderReady
TdiInitialize
TdiRegisterProvider
TdiRegisterPnPHandlers
TdiMapUserRequest
TdiDeregisterPnPHandlers
TdiDeregisterProvider
TdiRegisterDeviceObject
TdiDefaultDisconnectHandler
TdiDefaultErrorHandler
TdiDefaultReceiveHandler
TdiDefaultRcvExpeditedHandler
TdiDefaultSendPossibleHandler
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
TdiDefaultRcvDatagramHandler
TdiBuildNetbiosAddress
TdiDeregisterDeviceObject
TdiDeregisterNetAddress
TdiPnPPowerComplete
TdiEnumerateAddresses
TdiDefaultConnectHandler
TdiPnPPowerRequest
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 896B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGENBT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ