Static task
static1
Behavioral task
behavioral1
Sample
82530e90506dda1d5535b3926737ff1955dc18faaeea65d961aff180e762ea2a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
82530e90506dda1d5535b3926737ff1955dc18faaeea65d961aff180e762ea2a.exe
Resource
win10v2004-20230915-en
General
-
Target
82530e90506dda1d5535b3926737ff1955dc18faaeea65d961aff180e762ea2a
-
Size
23KB
-
MD5
d5b2f5644abdc6d53054b99c31ebe373
-
SHA1
32ea59f3c2809f6ce1a360ed22c0300e5cfbb279
-
SHA256
82530e90506dda1d5535b3926737ff1955dc18faaeea65d961aff180e762ea2a
-
SHA512
81b3447409fe3c0a5609d899fc6422f679d89c37c047c8584bacf302f63d99045b140cfce89e1084477357207101afa7395951be33373f4377cbc6e4c56f52c9
-
SSDEEP
384:8OHOD7dYm+oBhaphZ6YM+h4/Z+t8bBuSfC0zmN9coftMFFR/i6h4UxvdkkNHgz:8w0SK8phZ6T+eEt6gSfLmN9coftMF3/Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82530e90506dda1d5535b3926737ff1955dc18faaeea65d961aff180e762ea2a
Files
-
82530e90506dda1d5535b3926737ff1955dc18faaeea65d961aff180e762ea2a.exe windows x86
ecc65d0c0f7deb6513c1bec5b871763c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoGetDeviceProperty
MmUnmapIoSpace
ObfDereferenceObject
KeInitializeSpinLock
swprintf
MmMapIoSpace
IoGetDmaAdapter
WRITE_REGISTER_ULONG
READ_REGISTER_ULONG
WRITE_REGISTER_UCHAR
WRITE_REGISTER_USHORT
READ_REGISTER_UCHAR
READ_REGISTER_USHORT
ObReferenceObjectByHandle
KeTickCount
KeBugCheckEx
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memset
RtlCopyUnicodeString
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
KeSetEvent
ExFreePoolWithTag
hal
WRITE_PORT_ULONG
KfReleaseSpinLock
KfAcquireSpinLock
READ_PORT_ULONG
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbind
WdfVersionUnbindClass
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 493B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ