Static task
static1
Behavioral task
behavioral1
Sample
dea9227eb3171cdc733bdf1d8e13df770fd10d4230162a8b98aa40a76d416106.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dea9227eb3171cdc733bdf1d8e13df770fd10d4230162a8b98aa40a76d416106.exe
Resource
win10v2004-20221111-en
General
-
Target
dea9227eb3171cdc733bdf1d8e13df770fd10d4230162a8b98aa40a76d416106
-
Size
11KB
-
MD5
139ece9e47e2482b95db920fccbeba85
-
SHA1
17a872cd7eab2fcd305dab9292a86012e4ec7214
-
SHA256
dea9227eb3171cdc733bdf1d8e13df770fd10d4230162a8b98aa40a76d416106
-
SHA512
828992e9f6b7f0d0db5a9eb54fad26f230d99655362dd5cbabd5baacba3be6e9c3ce3aea95dfe23e873d4f2923609e5added1169dc63b46700b5ae838b2a685e
-
SSDEEP
192:32ZYmFNNF0zgOYj2jO5DgNueTbs6NWH8okXG:mZYQbFM9Y6jn7NTokW
Malware Config
Signatures
Files
-
dea9227eb3171cdc733bdf1d8e13df770fd10d4230162a8b98aa40a76d416106.exe windows x86
c3a722b029dc17685aaf0656fd9c2392
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
DbgPrint
ExFreePoolWithTag
KeWaitForSingleObject
memmove
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
memset
_allmul
IofCompleteRequest
KeTickCount
KeBugCheckEx
IoRegisterFsRegistrationChange
IoDriverObjectType
ObReferenceObjectByName
MmProbeAndLockPages
KeGetCurrentThread
RtlUnwind
hal
KeGetCurrentIrql
KfRaiseIrql
KfLowerIrql
KeStallExecutionProcessor
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hotp1 Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 788B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 350B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ