Static task
static1
Behavioral task
behavioral1
Sample
ec3fd5c4d66c1fb48ed68df85577810f961c4de3a49767a4fcd787d5277f1974.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ec3fd5c4d66c1fb48ed68df85577810f961c4de3a49767a4fcd787d5277f1974.exe
Resource
win10v2004-20220901-en
General
-
Target
ec3fd5c4d66c1fb48ed68df85577810f961c4de3a49767a4fcd787d5277f1974
-
Size
9KB
-
MD5
a31733f5c1553321664be48f152061f2
-
SHA1
cebed87824e70a2a50a6469a22e2ce823fe7dc57
-
SHA256
ec3fd5c4d66c1fb48ed68df85577810f961c4de3a49767a4fcd787d5277f1974
-
SHA512
e9c1439cb60ae723ff1497cbee6b59c806aa9cc140b50a24dcf8ee18274e59172ded1feb533cd20743aad0860cf4e2b8b207fb48e710fe187640506aecaec58b
-
SSDEEP
192:8wC7AysVvAXUP4ZANhRx0sf3GMwDVbBwmhiYie/zTy:Z4Ays2XHOhRx0sfrwDVbBwZpE
Malware Config
Signatures
Files
-
ec3fd5c4d66c1fb48ed68df85577810f961c4de3a49767a4fcd787d5277f1974.exe windows x86
18aa26281d500b06477be856469004f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDelayExecutionThread
IofCompleteRequest
atol
strncmp
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
_except_handler3
ZwClose
PsCreateSystemThread
KeInitializeEvent
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
ZwDeviceIoControlFile
sprintf
RtlFreeAnsiString
RtlCompareMemory
RtlUnicodeStringToAnsiString
RtlInitAnsiString
ZwCreateFile
KeSetEvent
ExAllocatePoolWithTag
ExFreePoolWithTag
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
PsTerminateSystemThread
IoGetCurrentProcess
strncpy
MmIsAddressValid
PsGetVersion
wcslen
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
KeTickCount
KeBugCheckEx
RtlInitUnicodeString
IoDeleteSymbolicLink
ZwWriteFile
IoDeleteDevice
hal
KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 892B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ