Static task
static1
Behavioral task
behavioral1
Sample
94f6f8eae9e0c5900e474e6c8e842603a3dcc9871fd8aade144a45ef21f772f3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
94f6f8eae9e0c5900e474e6c8e842603a3dcc9871fd8aade144a45ef21f772f3.exe
Resource
win10v2004-20220812-en
General
-
Target
94f6f8eae9e0c5900e474e6c8e842603a3dcc9871fd8aade144a45ef21f772f3
-
Size
77KB
-
MD5
8260759088d46682bfde6c1ebe43f230
-
SHA1
733eda9e09d28b893e402bb49421c9768cdf63fe
-
SHA256
94f6f8eae9e0c5900e474e6c8e842603a3dcc9871fd8aade144a45ef21f772f3
-
SHA512
3ce2fa89e1a2ba4ca8024312edf8d6b2e6ae26cc862a922554fae72fb1983599f0292fccf73516961c3b75ac2664442de389a42c93330edb7bc086f0b9617480
-
SSDEEP
768:l9o52xGYZOK1iNL9urVQVnek69E+e+xHSMHzzK3Bh/749WtbxsUQ:l9owRZkp9uQVU9E+vFSn/k9+sUQ
Malware Config
Signatures
Files
-
94f6f8eae9e0c5900e474e6c8e842603a3dcc9871fd8aade144a45ef21f772f3.exe windows x86
0202e25b3ff2fa77a456a785a3f0541b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
ZwCreateFile
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
memset
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
IofCompleteRequest
IoCancelIrp
KeQueryTimeIncrement
KeTickCount
_alldiv
_allmul
ZwFlushKey
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
memcpy
IoDeleteDevice
IoDeleteSymbolicLink
IoGetDeviceObjectPointer
IoCreateSymbolicLink
IoCreateDevice
IoGetLowerDeviceObject
ZwUnloadDriver
ZwDeleteKey
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlRandomEx
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeQuerySystemTime
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAllocatePool
ExFreePoolWithTag
KeInitializeEvent
IoDetachDevice
RtlCompareMemory
MmIsAddressValid
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
PsGetCurrentProcessId
memmove
strncpy
_snprintf
PsGetCurrentThreadId
ZwEnumerateKey
DbgPrint
strstr
_strnicmp
RtlCompareUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwReadFile
ZwWaitForSingleObject
ZwQueryInformationFile
IoCreateFileSpecifyDeviceObjectHint
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
ObQueryNameString
RtlFreeUnicodeString
swprintf
ZwDeviceIoControlFile
ZwFsControlFile
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoGetDeviceAttachmentBaseRef
IoAttachDeviceToDeviceStackSafe
PsTerminateSystemThread
KeSetTimerEx
KeSetPriorityThread
KeGetCurrentThread
KeCancelTimer
PsCreateSystemThread
KeInitializeTimerEx
KeBugCheckEx
ObfDereferenceObject
KeWaitForSingleObject
ZwClose
RtlInitUnicodeString
IoAttachDeviceToDeviceStack
KeSetEvent
RtlAnsiCharToUnicodeChar
RtlUnwind
hal
KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeStallExecutionProcessor
KfReleaseSpinLock
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ