Static task
static1
Behavioral task
behavioral1
Sample
bc63314950d7e44457febd44a39a6425581ff763287863a51dda2d88e0d57050.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bc63314950d7e44457febd44a39a6425581ff763287863a51dda2d88e0d57050.exe
Resource
win10v2004-20220812-en
General
-
Target
bc63314950d7e44457febd44a39a6425581ff763287863a51dda2d88e0d57050
-
Size
8KB
-
MD5
ea0f268453d0878de30885b49e2f64a2
-
SHA1
cfdd7f0184ec92feae6d2e75aca7576da111df88
-
SHA256
bc63314950d7e44457febd44a39a6425581ff763287863a51dda2d88e0d57050
-
SHA512
ace2689c0d8319a7927eda0cd2ec8ef4d542aa4ff3c222d28ebe84d96bdf25291de782ea299d8dd0e50e8e6f4f16aef26fd7ad08cc93f3f85087d015bfb88675
-
SSDEEP
192:D06EZIfySFSSX9cx1NEswQfsLzeA04QZpPXjj/VFvHn9x7QeO:D06EZIi1SLQfsLaTn/VFfnze
Malware Config
Signatures
Files
-
bc63314950d7e44457febd44a39a6425581ff763287863a51dda2d88e0d57050.exe windows x86
37d7d43d8af67d691484420536d9ce54
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ndis.sys
NdisGetCurrentSystemTime
NdisRegisterProtocol
ntoskrnl.exe
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
KeServiceDescriptorTable
MmIsAddressValid
IoGetCurrentProcess
PsLookupProcessByProcessId
ObDereferenceObject
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
PsGetCurrentProcessId
IoCreateFile
IofCallDriver
ZwAllocateVirtualMemory
RtlCompareUnicodeString
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 336B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 336B - Virtual size: 326B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 608B - Virtual size: 594B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 688B - Virtual size: 682B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ