Static task
static1
Behavioral task
behavioral1
Sample
c09cf83212381e35d39a7d72457465d9379426606323d1347c307031810eb953.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c09cf83212381e35d39a7d72457465d9379426606323d1347c307031810eb953.exe
Resource
win10v2004-20230703-en
General
-
Target
c09cf83212381e35d39a7d72457465d9379426606323d1347c307031810eb953
-
Size
23KB
-
MD5
d5374aa2c0ee834a01ad663e90bb12d8
-
SHA1
736aafdacae7d82e636a7f84374bc8b4b8d3f23b
-
SHA256
c09cf83212381e35d39a7d72457465d9379426606323d1347c307031810eb953
-
SHA512
fa65c64d39c457704e40a1f02ee47da5128c0e41fd15ad83d0f1a3d065e559e1f44bef89116d5dd275de23cea8d3be73777966314b61de15e5b262f306f1d2fb
-
SSDEEP
384:8QRODYdYm+oBhaphZ6YJAkQ27nWIXBMSfCYtfqeJRtMgPPi0h4USOvrzgu:880FK8phZ6UAnYWWySfRfqeJRtM0Piiz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c09cf83212381e35d39a7d72457465d9379426606323d1347c307031810eb953
Files
-
c09cf83212381e35d39a7d72457465d9379426606323d1347c307031810eb953.exe windows x86
160f768f135a81977b54fb141186b365
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoGetDeviceProperty
MmUnmapIoSpace
ObfDereferenceObject
KeInitializeSpinLock
swprintf
MmMapIoSpace
IoGetDmaAdapter
WRITE_REGISTER_ULONG
READ_REGISTER_ULONG
WRITE_REGISTER_UCHAR
READ_REGISTER_USHORT
WRITE_REGISTER_USHORT
READ_REGISTER_UCHAR
ObReferenceObjectByHandle
KeTickCount
KeBugCheckEx
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memset
RtlCopyUnicodeString
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
KeSetEvent
ExFreePoolWithTag
hal
WRITE_PORT_ULONG
KfReleaseSpinLock
KfAcquireSpinLock
READ_PORT_ULONG
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbind
WdfVersionUnbindClass
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 456B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ