Static task
static1
Behavioral task
behavioral1
Sample
44ea7128000376182e9e5cf9c2cde4c760e194311011e8b70f73e3e60d8132f5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
44ea7128000376182e9e5cf9c2cde4c760e194311011e8b70f73e3e60d8132f5.exe
Resource
win10v2004-20220812-en
General
-
Target
44ea7128000376182e9e5cf9c2cde4c760e194311011e8b70f73e3e60d8132f5
-
Size
38KB
-
MD5
6a8a7f4e98bd75812e5630eee5f81810
-
SHA1
0fb3ff3bf795f023fd828412149c50d9313f6458
-
SHA256
44ea7128000376182e9e5cf9c2cde4c760e194311011e8b70f73e3e60d8132f5
-
SHA512
855e97031339b958b46362c92d336147cabac31e5113af3a11a55c456fa6fdff1f3331e8eee8d42d368770ef196cb96144a711940f6259aff11a997a07727684
-
SSDEEP
768:Roq2TqtsSnwtlYbgiVChlpGwBnliCNCxEoAm43lLRA:RL2utssylMFCrpGw6CsOHRA
Malware Config
Signatures
Files
-
44ea7128000376182e9e5cf9c2cde4c760e194311011e8b70f73e3e60d8132f5.exe windows x86
ea0d2c1edbdd650e742547774fc9f7b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCompareUnicodeString
RtlInitUnicodeString
ZwClose
ZwSetValueKey
ZwCreateKey
_wcsicmp
wcsncpy
wcslen
wcsrchr
swprintf
wcscat
wcscpy
ZwQueryValueKey
ZwOpenKey
_except_handler3
ObReferenceObjectByHandle
ZwSetInformationFile
ZwCreateFile
MmGetSystemRoutineAddress
strncmp
IoGetCurrentProcess
KeTickCount
KeQueryTimeIncrement
_stricmp
MmIsAddressValid
RtlAnsiStringToUnicodeString
_snwprintf
wcschr
wcsstr
_wcslwr
strncpy
PsLookupProcessByProcessId
ObfDereferenceObject
IoRegisterDriverReinitialization
ZwDeleteKey
ExFreePool
_snprintf
ExAllocatePoolWithTag
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_wcsnicmp
KeDelayExecutionThread
KeQuerySystemTime
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoDeviceObjectType
PsGetVersion
RtlCopyUnicodeString
PsCreateSystemThread
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 43B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ