Static task
static1
Behavioral task
behavioral1
Sample
0b2b3e8c17143679828e3f84e15a67834c5af445d3e9e365821864f3a7d5ce21.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b2b3e8c17143679828e3f84e15a67834c5af445d3e9e365821864f3a7d5ce21.exe
Resource
win10v2004-20220901-en
General
-
Target
0b2b3e8c17143679828e3f84e15a67834c5af445d3e9e365821864f3a7d5ce21
-
Size
3KB
-
MD5
a1d296bb5478bb6005f2670706261188
-
SHA1
42d00a8cc4a8ce08c082c571fedf9f30684c4a08
-
SHA256
0b2b3e8c17143679828e3f84e15a67834c5af445d3e9e365821864f3a7d5ce21
-
SHA512
9f3cd37a018d4b3b9dd3ff5de2ae2c2672bd5888a229b37da6c04a528aa2f16e1198ac6d8708537063f194671d3e85667af0cfa3afbc4669165cb67ca6789ef7
Malware Config
Signatures
Files
-
0b2b3e8c17143679828e3f84e15a67834c5af445d3e9e365821864f3a7d5ce21.exe windows x86
47da9225c89a6a0109ab8e7d41973376
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlCompareMemory
RtlUpcaseUnicodeString
memcpy
ExFreePoolWithTag
ZwCreateKey
ZwQueryValueKey
ExAllocatePool
KeTickCount
KeBugCheckEx
ZwSetValueKey
ZwClose
PsSetLoadImageNotifyRoutine
RtlFreeUnicodeString
fltmgr.sys
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 552B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ