Static task
static1
Behavioral task
behavioral1
Sample
3c8c8451e20290398923ca457cdeb21d203c24d2a6610cfbb1cd10f058e4aa4e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3c8c8451e20290398923ca457cdeb21d203c24d2a6610cfbb1cd10f058e4aa4e.exe
Resource
win10v2004-20220901-en
General
-
Target
3c8c8451e20290398923ca457cdeb21d203c24d2a6610cfbb1cd10f058e4aa4e
-
Size
4KB
-
MD5
6db2f2bd25de095b77032f43c1b0ccdb
-
SHA1
9f3b2a3a09d79e67f393a5102013182245f46485
-
SHA256
3c8c8451e20290398923ca457cdeb21d203c24d2a6610cfbb1cd10f058e4aa4e
-
SHA512
ea9913aa96ddae5df774129c3900c4d5a7353dc0e8cfda5dcc0d66433143096d1740d427d16480b24b506e49d4b025b0a7fcf31c97ba6f139b873e1ea0a9d95c
Malware Config
Signatures
Files
-
3c8c8451e20290398923ca457cdeb21d203c24d2a6610cfbb1cd10f058e4aa4e.exe windows x86
36f832a5045ea78e93ebec9679cea797
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
RtlFreeAnsiString
strncpy
RtlUnicodeStringToAnsiString
ObQueryNameString
KeDetachProcess
ObfDereferenceObject
ObReferenceObjectByHandle
KeAttachProcess
PsLookupProcessByProcessId
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 676B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ