Static task
static1
Behavioral task
behavioral1
Sample
9361089c6ebe7735521e1ffed0d83a2d7cfd176c01101e90f65760cda26011a3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9361089c6ebe7735521e1ffed0d83a2d7cfd176c01101e90f65760cda26011a3.exe
Resource
win10v2004-20220812-en
General
-
Target
9361089c6ebe7735521e1ffed0d83a2d7cfd176c01101e90f65760cda26011a3
-
Size
16KB
-
MD5
11b3af70fad5f4495ce163a4a5f56700
-
SHA1
ca3cdf362d963cacd3ceaa430b2cd696007522ca
-
SHA256
9361089c6ebe7735521e1ffed0d83a2d7cfd176c01101e90f65760cda26011a3
-
SHA512
895b892393fbad44cbc88b2a134083c259d8d1ec9fd1eb62fb36c7e19761573271a0145ca5802358836d6fe95d8a0a08db45e92e604297baa0dd3e33e5aa9bb8
-
SSDEEP
96:kQYMvs4wNkymwj6nWooTwjdhPzbicVf0aeZFouroCQIta0wyOHoKHKO:rYCNwNZ3ooCzbicVf0a0qSM0nuoKqO
Malware Config
Signatures
Files
-
9361089c6ebe7735521e1ffed0d83a2d7cfd176c01101e90f65760cda26011a3.exe windows x86
b8d25b0f428c8aa321d54cdbc89da389
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
ntoskrnl.exe
MmIsAddressValid
ZwClose
ZwOpenKey
RtlFreeUnicodeString
ZwDeleteFile
RtlInitUnicodeString
ZwQueryValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
strrchr
ZwQuerySystemInformation
RtlCompareMemory
ObfDereferenceObject
KeUnstackDetachProcess
ZwUnmapViewOfSection
ProbeForWrite
ProbeForRead
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
KeStackAttachProcess
PsLookupProcessByProcessId
_except_handler3
NtBuildNumber
ExFreePool
RtlCompareUnicodeString
ExAllocatePoolWithTag
hal
KfLowerIrql
KfRaiseIrql
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 800B - Virtual size: 800B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 320B - Virtual size: 310B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ