Static task
static1
Behavioral task
behavioral1
Sample
6a018e042fe77657a7f6986f5d9c6716b9995afdf9434bc640affb8f28bc429c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6a018e042fe77657a7f6986f5d9c6716b9995afdf9434bc640affb8f28bc429c.exe
Resource
win10v2004-20220812-en
General
-
Target
6a018e042fe77657a7f6986f5d9c6716b9995afdf9434bc640affb8f28bc429c
-
Size
23KB
-
MD5
4e737bfd10eece29796ff453c016edb0
-
SHA1
0ba39433753ef6181cf759c02dc66533766c9081
-
SHA256
6a018e042fe77657a7f6986f5d9c6716b9995afdf9434bc640affb8f28bc429c
-
SHA512
3e4b26da43fd859f008e18bafc7b9c884fb649158d7d1a728abfb35ef6d07f5ee9b06cb38dbbb4308a50564d1db7ade2d9d6e6b2f7b7c64c932aa9e205194651
-
SSDEEP
384:Y+j7uS7uS7uS7uS7uS7uS7uCEXPIFG7vrl1rA3+x+OtrIvhe0HREQUgyedl/Fyhy:Y+j7l7l7l7l7l7l7FEXPIFG7x1rsgFIN
Malware Config
Signatures
Files
-
6a018e042fe77657a7f6986f5d9c6716b9995afdf9434bc640affb8f28bc429c.exe windows x86
06134b71d8f165e4696bfd815bd70edb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwPulseEvent
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
RtlInitUnicodeString
MmUserProbeAddress
ProbeForWrite
ProbeForRead
_except_handler3
_stricmp
IofCompleteRequest
ExFreePool
strrchr
ExAllocatePoolWithTag
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 864B - Virtual size: 852B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t1ata Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.v3ata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 864B - Virtual size: 846B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 928B - Virtual size: 910B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ