Static task
static1
Behavioral task
behavioral1
Sample
f2f2314490b6910038ef8e0ce4fc9133fd588b559fa1fe202157d4573cc91ebb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2f2314490b6910038ef8e0ce4fc9133fd588b559fa1fe202157d4573cc91ebb.exe
Resource
win10v2004-20220812-en
General
-
Target
f2f2314490b6910038ef8e0ce4fc9133fd588b559fa1fe202157d4573cc91ebb
-
Size
9KB
-
MD5
d7edaa610da58dbe3363e2afb3e8ab9b
-
SHA1
bab0a0ccac7ec0c2134a299fc40307e7828536ee
-
SHA256
f2f2314490b6910038ef8e0ce4fc9133fd588b559fa1fe202157d4573cc91ebb
-
SHA512
7ddd2f19ba7a521ab7cff4eac876ab4440ffc3a418ee8d46356c7f8d98b7efb5b20936c4e24be5bd8250631c63d3a90cdcf7887f8ae4af6a7467320e6b3666e2
-
SSDEEP
192:gh+9sVKdMcJmoEWOpC3d1MJQnm29eM8xdz92Y+kEb:gh+eYMcJmoEWiCwWnXsLxdzh+k
Malware Config
Signatures
Files
-
f2f2314490b6910038ef8e0ce4fc9133fd588b559fa1fe202157d4573cc91ebb.exe windows x86
b6073e958768afb40bb9865dc1b98243
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
DbgPrint
ExGetPreviousMode
ProbeForWrite
ProbeForRead
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
MmIsAddressValid
_except_handler3
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsTerminateSystemThread
ExFreePool
ZwQuerySystemInformation
ZwPulseEvent
MmGetSystemRoutineAddress
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 800B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 932B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 448B - Virtual size: 438B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ