Static task
static1
Behavioral task
behavioral1
Sample
44ffc539339ba16ec51c2419a33720057d8450a1f2aae7e122e281c9007567fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
44ffc539339ba16ec51c2419a33720057d8450a1f2aae7e122e281c9007567fa.exe
Resource
win10v2004-20220812-en
General
-
Target
44ffc539339ba16ec51c2419a33720057d8450a1f2aae7e122e281c9007567fa
-
Size
36KB
-
MD5
a295ec73b031a3c46abe68f4ab895dac
-
SHA1
32302e21c872a6b7b02da5bcf0148976fe94001a
-
SHA256
44ffc539339ba16ec51c2419a33720057d8450a1f2aae7e122e281c9007567fa
-
SHA512
5fb68db7d81b540a605ee35ba01ec64cf1049ef08f62186fe3ba236ec359f137991566c0a474169ab41c24b065d52a7a6ce6cb247960bc4a5be069e2b259a3fd
-
SSDEEP
768:4TBu/S+IGK4amvkH5M78/7wspiuYC7cQ/+GMK+/:4TBu/MGGz5MuT/7fGGY/
Malware Config
Signatures
Files
-
44ffc539339ba16ec51c2419a33720057d8450a1f2aae7e122e281c9007567fa.exe windows x86
73d1a1d8ab987546c07a3d297e37d52d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
_wcsicmp
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
RtlInitUnicodeString
wcsncpy
wcsrchr
wcslen
RtlCompareUnicodeString
KeTickCount
KeQueryTimeIncrement
swprintf
wcscat
wcscpy
ZwCreateKey
ZwQueryValueKey
_except_handler3
_snwprintf
wcschr
wcsstr
_wcslwr
RtlCopyUnicodeString
_stricmp
IofCompleteRequest
RtlAnsiStringToUnicodeString
strncpy
IoGetCurrentProcess
KeDelayExecutionThread
KeQuerySystemTime
IoDeviceObjectType
ZwDeleteKey
ZwQueryKey
_wcsnicmp
ObQueryNameString
_snprintf
PsCreateSystemThread
ZwCreateFile
PsSetCreateProcessNotifyRoutine
strncmp
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetInformationFile
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 78B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ