Static task
static1
Behavioral task
behavioral1
Sample
de5ab50db7968bb37139a8ddb1ed9e67bdccb1b2b0946365bae6e945b9b092a7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
de5ab50db7968bb37139a8ddb1ed9e67bdccb1b2b0946365bae6e945b9b092a7.exe
Resource
win10v2004-20220901-en
General
-
Target
de5ab50db7968bb37139a8ddb1ed9e67bdccb1b2b0946365bae6e945b9b092a7
-
Size
5KB
-
MD5
91495cfc242b92316479d96c37773acf
-
SHA1
d42d216fee453beaa2ce02652fef3a7e2ce6b890
-
SHA256
de5ab50db7968bb37139a8ddb1ed9e67bdccb1b2b0946365bae6e945b9b092a7
-
SHA512
656a7d92ef4455c03c10f158c27abda4ed5cea3f607dcc3d44b9ca231c246cc41f0e5ddd2f31aaed6e0f0235a9800f51a0138873a5d44e5cb09c335b0712f206
-
SSDEEP
48:iZ48isnt3tpgB5JW0wWomQl2hy4L64Mmp2wqVlVdA66bUVtRrgnb:atd2B5JWRl2P3byA61gnb
Malware Config
Signatures
Files
-
de5ab50db7968bb37139a8ddb1ed9e67bdccb1b2b0946365bae6e945b9b092a7.exe windows x86
8d7ea1d63197dfde206cf46bb1ff92bd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
ZwOpenProcess
PsProcessType
ZwClose
ZwAssignProcessToJobObject
ZwCreateJobObject
ZwTerminateJobObject
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
_stricmp
ObReferenceObjectByHandle
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 534B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ