Static task
static1
Behavioral task
behavioral1
Sample
e5cfe020bfeab4f80f87a31826199a9d2081f9e53cd3a0edcf42aaef3fc4eff8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e5cfe020bfeab4f80f87a31826199a9d2081f9e53cd3a0edcf42aaef3fc4eff8.exe
Resource
win10v2004-20221111-en
General
-
Target
e5cfe020bfeab4f80f87a31826199a9d2081f9e53cd3a0edcf42aaef3fc4eff8
-
Size
6KB
-
MD5
e7cf260b096c01062f1cee52d955a014
-
SHA1
4273702a26629562079786fbbe3f434becf60e22
-
SHA256
e5cfe020bfeab4f80f87a31826199a9d2081f9e53cd3a0edcf42aaef3fc4eff8
-
SHA512
6673e82123b09d00e4de1be43b48d360ad770c14985db5ae4e0be255a0b19f5df12f088056b3fdebf724e037c67b85fb8f09e5d82b26d13d7dbbc652a7a97728
-
SSDEEP
96:SzS+JXqkrJjhbyXCt/b7h5B1R5B1LK1HJAp4a:MSK6krJjkXqTF5jLjA0
Malware Config
Signatures
Files
-
e5cfe020bfeab4f80f87a31826199a9d2081f9e53cd3a0edcf42aaef3fc4eff8.exe windows x86
5655279d6fe2eb2e75d80cdb16986331
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeServiceDescriptorTable
ZwQueryDirectoryFile
RtlEqualUnicodeString
RtlInitUnicodeString
IofCompleteRequest
ExAllocatePoolWithTag
ExFreePoolWithTag
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
ZwEnumerateValueKey
ZwEnumerateKey
ZwDeviceIoControlFile
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ