Static task
static1
Behavioral task
behavioral1
Sample
7d1d51de5957dab34968f6660c48cdfcaf6efb4346dea2eec6de80e0e89a2014.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7d1d51de5957dab34968f6660c48cdfcaf6efb4346dea2eec6de80e0e89a2014.exe
Resource
win10v2004-20220812-en
General
-
Target
7d1d51de5957dab34968f6660c48cdfcaf6efb4346dea2eec6de80e0e89a2014
-
Size
11KB
-
MD5
a0143ae8783ba1ebd6908a10eae91cc0
-
SHA1
653b4ea2cb79c6287643e122b93b84f067ee8364
-
SHA256
7d1d51de5957dab34968f6660c48cdfcaf6efb4346dea2eec6de80e0e89a2014
-
SHA512
78db27abc2298d25c5e28db5623760bf983c08b8775746d46e1194da3869b562ee28d2f4b3f09e56cb9bf4294b1858e4402b83a2e69fb14d632fbf24d5cfd4f5
-
SSDEEP
192:PAC7p1e7uLaSVJqF3CFTUdqva61svumPEj:Y17uLa7+TUdqaesU
Malware Config
Signatures
Files
-
7d1d51de5957dab34968f6660c48cdfcaf6efb4346dea2eec6de80e0e89a2014.exe windows x86
a3e37b49a34f808bc022ec3dd6166cd2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ExFreePoolWithTag
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ExAllocatePoolWithTag
wcscat
swprintf
strchr
ZwClose
ZwSetValueKey
RtlInitUnicodeString
ZwOpenKey
RtlCompareMemory
RtlUpperString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwEnumerateKey
ZwDeviceIoControlFile
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_wcsupr
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 812B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 474B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ