Static task
static1
Behavioral task
behavioral1
Sample
dac1ae8dedf16f79e507396c65582b7cb479316e101a6af5375527df4d8ae58b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
dac1ae8dedf16f79e507396c65582b7cb479316e101a6af5375527df4d8ae58b.exe
Resource
win10v2004-20221111-en
General
-
Target
dac1ae8dedf16f79e507396c65582b7cb479316e101a6af5375527df4d8ae58b
-
Size
7KB
-
MD5
150534ff72aa182dca6b4632780f70a8
-
SHA1
fc89f343e3e0c036dd23202cde388871aa22e12a
-
SHA256
dac1ae8dedf16f79e507396c65582b7cb479316e101a6af5375527df4d8ae58b
-
SHA512
3da31684765c547ac5d7720d3480ceab94ab22c973c103791f97d9f4dbdb14134ed061dbf130fc5f2518214a3462f61507265ed6a7459cf0a7559cb3bb3e915f
-
SSDEEP
96:41nyJPReA2ACCm5DECRtatHslS5lDtugFmXtSQDXGVi:SnyJQLN/tatMlS5lDtug4UVi
Malware Config
Signatures
Files
-
dac1ae8dedf16f79e507396c65582b7cb479316e101a6af5375527df4d8ae58b.exe windows x86
007bdf002977e561dde852827593374b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
strncpy
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ExFreePoolWithTag
DbgPrint
ExAllocatePoolWithTag
PsGetCurrentProcessId
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
IofCompleteRequest
ZwDeviceIoControlFile
ZwQuerySystemInformation
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
strstr
_strupr
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 217B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 648B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 426B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ