Static task
static1
Behavioral task
behavioral1
Sample
853940ca69eeef9550ecfc5f866cfb278425287d0d3b1979c97290a1d6ae7cd4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
853940ca69eeef9550ecfc5f866cfb278425287d0d3b1979c97290a1d6ae7cd4.exe
Resource
win10v2004-20220901-en
General
-
Target
853940ca69eeef9550ecfc5f866cfb278425287d0d3b1979c97290a1d6ae7cd4
-
Size
16KB
-
MD5
83f148b4e21117f4c07e81ae13c942a7
-
SHA1
e4b6bf80222291ae676399886eae8dec1cfa7a8e
-
SHA256
853940ca69eeef9550ecfc5f866cfb278425287d0d3b1979c97290a1d6ae7cd4
-
SHA512
dcb2274be7da5e06b4d628a0a3f2e97a33ffa0b9682097c9f6f92e8562906da4a66008a2bc209626a0d11d0240a23fbe5c98cdd5f680aaa7255ebd6670a67321
-
SSDEEP
384:IPzfed+UYR0TnyhFWsIpiKnE4T7pYF4u3UVaDwBt3oZSbMtGPZbvDSIbvDSzO:IrksIpiKE4T7pYF4u3UVaDwBt3oZSbMB
Malware Config
Signatures
Files
-
853940ca69eeef9550ecfc5f866cfb278425287d0d3b1979c97290a1d6ae7cd4.exe windows x86
049918184e8b62c672ca3d75c081b13c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strlen
ZwClose
ExFreePool
ZwWriteFile
strcat
memset
ExAllocatePoolWithTag
ZwCreateFile
RtlInitUnicodeString
_stricmp
strncmp
IoGetCurrentProcess
_except_handler3
RtlFreeUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
wcscpy
wcscat
ZwEnumerateKey
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
_wcsnicmp
wcslen
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 904B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ