Static task
static1
Behavioral task
behavioral1
Sample
8685083d57228cb6ad8a835822f38ad07f18143b9844874034d40b4536ca1113.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8685083d57228cb6ad8a835822f38ad07f18143b9844874034d40b4536ca1113.exe
Resource
win10v2004-20220901-en
General
-
Target
8685083d57228cb6ad8a835822f38ad07f18143b9844874034d40b4536ca1113
-
Size
15KB
-
MD5
6f0888b02d3266cc1d9c25afe9a699e4
-
SHA1
4a5deec168ed2dececd1700d457ec7684046f9d0
-
SHA256
8685083d57228cb6ad8a835822f38ad07f18143b9844874034d40b4536ca1113
-
SHA512
ad13fed069593eb82fa00e75e4d485c53058f0149c411c2a6bbafecea7aff296a8237fc83837ef22407827652489afe597af143b3344ee3a80e07b16ff411d14
-
SSDEEP
384:/+Qbw0OwufUvEo2+KX8owLTBUu1ItktDHrrO/:/+Qk9Uvi+KMvfBUF
Malware Config
Signatures
Files
-
8685083d57228cb6ad8a835822f38ad07f18143b9844874034d40b4536ca1113.exe windows x86
564a6db9cac033f86527668869135ddb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
PsTerminateSystemThread
ExFreePool
RtlFreeAnsiString
_stricmp
_strlwr
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
ZwQuerySystemInformation
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
_strupr
strrchr
PsSetLoadImageNotifyRoutine
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IoDeleteSymbolicLink
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 946B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 358B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ