Static task
static1
Behavioral task
behavioral1
Sample
0081728274b5e113d192bdb13b7529b8bbfff9f3453361f0376508a1267b64f2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0081728274b5e113d192bdb13b7529b8bbfff9f3453361f0376508a1267b64f2.exe
Resource
win10v2004-20220812-en
General
-
Target
0081728274b5e113d192bdb13b7529b8bbfff9f3453361f0376508a1267b64f2
-
Size
37KB
-
MD5
20cf5c9550e086ee34925773e3d123df
-
SHA1
949fcdc902eccf4f8a28696a90e669a83610f48d
-
SHA256
0081728274b5e113d192bdb13b7529b8bbfff9f3453361f0376508a1267b64f2
-
SHA512
15a865d637df2eb5f01c053c59ed9c0f9b84b2f8512b96da324e7083413bd00483b61936086b1b70462f5b8cd5de4e1894316d9c845965198f5cc2ca5eb1e73b
-
SSDEEP
768:H77iv8IExMy3jIupdc0anaZvwU1l2fqCuGBB44ZwHIxaVlAz494uDtGkgvMz:b7ikpxMIpdPanivwU1QfGGE4mIcD12q
Malware Config
Signatures
Files
-
0081728274b5e113d192bdb13b7529b8bbfff9f3453361f0376508a1267b64f2.exe windows x86
3c0b224141f06f5d410ff59b2937e9a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_stricmp
swprintf
wcsstr
_wcslwr
PsSetCreateProcessNotifyRoutine
ZwSetValueKey
wcslen
ZwClose
ZwCreateKey
RtlInitUnicodeString
ZwDeleteKey
ZwOpenKey
MmIsAddressValid
_wcsicmp
wcsncpy
wcsrchr
ZwQueryValueKey
ZwSetInformationFile
ZwCreateFile
wcscpy
MmGetSystemRoutineAddress
RtlCompareUnicodeString
_snwprintf
wcschr
KeDelayExecutionThread
KeQuerySystemTime
_except_handler3
IoRegisterDriverReinitialization
strncpy
IoGetCurrentProcess
ExAllocatePoolWithTag
ExFreePool
_snprintf
strncmp
IoDeviceObjectType
PsCreateSystemThread
ObfDereferenceObject
_wcsnicmp
wcscat
RtlCopyUnicodeString
ObReferenceObjectByHandle
KeTickCount
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeQueryTimeIncrement
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 45B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ