Static task
static1
Behavioral task
behavioral1
Sample
e45f5300d6b6f8fc955099b5319844a016e87eba763efac64c7dd17091ac1836.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e45f5300d6b6f8fc955099b5319844a016e87eba763efac64c7dd17091ac1836.exe
Resource
win10v2004-20220901-en
General
-
Target
e45f5300d6b6f8fc955099b5319844a016e87eba763efac64c7dd17091ac1836
-
Size
36KB
-
MD5
049e9649e7fa71f6b7a8694f476a00fa
-
SHA1
aa44075b734660465e88f85e2d6c52439b3270f9
-
SHA256
e45f5300d6b6f8fc955099b5319844a016e87eba763efac64c7dd17091ac1836
-
SHA512
8f2b52763bfea1765e8ebb8cd1f9ccb6e4ac73d997d452cf156629ba8b5c927ffd3a23351cb764917da32c4de88de9eeec454b170c0e4d38552062ed2c914506
-
SSDEEP
768:du7rr2vzC6Tz01XFsvuL+XPJbFnsTFWnIzyk5bS1RA+rof:dunEI1X1yfJbFnsontsebj
Malware Config
Signatures
Files
-
e45f5300d6b6f8fc955099b5319844a016e87eba763efac64c7dd17091ac1836.exe windows x86
7715761a801eda9c01198ce260388f01
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeQuerySystemTime
wcslen
swprintf
wcscat
wcscpy
RtlInitUnicodeString
ZwSetValueKey
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
ZwSetInformationFile
ZwCreateFile
PsCreateSystemThread
KeDelayExecutionThread
wcsstr
_wcslwr
ObReferenceObjectByHandle
_wcsicmp
wcsncpy
wcsrchr
strncpy
IoGetCurrentProcess
MmIsAddressValid
IoDeviceObjectType
ZwCreateKey
IofCompleteRequest
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
KeTickCount
KeQueryTimeIncrement
_stricmp
ZwDeleteKey
_snwprintf
wcschr
_snprintf
strncmp
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
RtlCompareUnicodeString
_wcsnicmp
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 61B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ