Static task
static1
Behavioral task
behavioral1
Sample
00e08129f27bb4ee8efb07678d25e39e26d0171b88d924b8308614ae34a70926.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
00e08129f27bb4ee8efb07678d25e39e26d0171b88d924b8308614ae34a70926.exe
Resource
win10v2004-20220812-en
General
-
Target
00e08129f27bb4ee8efb07678d25e39e26d0171b88d924b8308614ae34a70926
-
Size
12KB
-
MD5
6e613a81c2ebae252cc4cb0020241ebb
-
SHA1
3821079c47ab08a49ca11976e1f895b798e2b763
-
SHA256
00e08129f27bb4ee8efb07678d25e39e26d0171b88d924b8308614ae34a70926
-
SHA512
084488a3d54363e343363ca0e3e410c5b1a5ff3207296549ecd00876bf7511a7194ab2b526cd5ef2304e02713aeb8ac95dbc752df99ef9704b128c13e2838052
-
SSDEEP
192:TushTkKyybIgqr4DLaHTMf+4I5Zo9eLV9s3rm335/wJirNmL/xNlA:Xh9bIgPXJm4szVsm3mirILO
Malware Config
Signatures
Files
-
00e08129f27bb4ee8efb07678d25e39e26d0171b88d924b8308614ae34a70926.exe windows x86
b7a9ada452380dbef2c10f17db0ca25c
Code Sign
09:35:77:6f:cd:60:c4:8a:43:24:39:26:7b:b7:44:bcCertificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CANot Before14-02-2012 08:40Not After31-12-2039 23:59SubjectCN=Tencent Technology(Shenzhen) Company Limited79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01-05-2012 00:00Not After31-12-2012 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04-12-2003 00:00Not After03-12-2013 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
_except_handler3
IoCreateFile
IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmGetSystemRoutineAddress
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IofCompleteRequest
ZwClose
KeServiceDescriptorTable
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
wcslen
hal
KeGetCurrentIrql
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 890B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ