Static task
static1
Behavioral task
behavioral1
Sample
516c6a28130aff1df922f03250af62ab.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
516c6a28130aff1df922f03250af62ab.exe
Resource
win10v2004-20231215-en
General
-
Target
516c6a28130aff1df922f03250af62ab
-
Size
27KB
-
MD5
516c6a28130aff1df922f03250af62ab
-
SHA1
61e8dd879232b2b9e45034c1206b216f1f4d82b7
-
SHA256
e82acf4d405b0f7293b0cbe0bcd37d59c7f3e4ab293b00602fd7c98cdbe3def4
-
SHA512
46cd4fc8ba61d810c94867768f60a71066782a651151884c6ecfd06e1daae4418c943910c02a93d69f13259e8a96d20213cd24ce88745c8e3131f33aca43a8c6
-
SSDEEP
384:3r5S8ae8IBxEl6RRzxCbyNIaoakEaqMCa1jazi6uPKaSnC6wJMogV3Qp0Ds1XH:3r5cri3RRpNIrqRl6oGXH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 516c6a28130aff1df922f03250af62ab
Files
-
516c6a28130aff1df922f03250af62ab.exe windows:5 windows x86 arch:x86
057d5250744df789ac4674c0dafff6da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeServiceDescriptorTable
memcpy
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePoolWithTag
ZwClose
PsCreateSystemThread
ZwQuerySystemInformation
PsGetCurrentProcessId
IoGetAttachedDevice
MmGetSystemRoutineAddress
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
memset
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
ExAllocatePoolWithTag
IoCreateFile
MmIsAddressValid
hal
KeGetCurrentIrql
KfLowerIrql
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 281B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ