Static task
static1
Behavioral task
behavioral1
Sample
1bc3df34846e3dbcd7c04d854636fd4be3a9a0c111dd7753e8dbd461bb661170.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1bc3df34846e3dbcd7c04d854636fd4be3a9a0c111dd7753e8dbd461bb661170.exe
Resource
win10v2004-20220901-en
General
-
Target
1bc3df34846e3dbcd7c04d854636fd4be3a9a0c111dd7753e8dbd461bb661170
-
Size
14KB
-
MD5
040d33da8491312eb8108a45585732f9
-
SHA1
8a6a30e3e8e79e909e2cccfe3486bad742182922
-
SHA256
1bc3df34846e3dbcd7c04d854636fd4be3a9a0c111dd7753e8dbd461bb661170
-
SHA512
881cf9ada9f5adfb93b479d8b8ef48adf17dd50fdda29f1d74c01ecc30c634b6edb9a7a98287214a8901964927685bc23d8c37f95d3b701e90c42729d5c338c4
-
SSDEEP
192:xTNk9vjvHDnyw/OGTPoRZ7JInKy4BqB4kg2ZhM7fxN9L1bz/BJ:svH5DReo2Lp
Malware Config
Signatures
Files
-
1bc3df34846e3dbcd7c04d854636fd4be3a9a0c111dd7753e8dbd461bb661170.exe windows x86
95843930aa8c765890ef262fe475c3f1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ProbeForWrite
ProbeForRead
_except_handler3
ObfDereferenceObject
ZwClose
RtlFreeUnicodeString
ObReferenceObjectByHandle
swprintf
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_alldiv
IoCreateFile
ZwQueryInformationFile
ZwReadFile
ZwDeviceIoControlFile
ZwCreateFile
RtlCompareMemory
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeInitializeEvent
KeGetCurrentThread
IoAllocateIrp
IoFreeIrp
KeSetEvent
IoBuildDeviceIoControlRequest
KeTickCount
KeBugCheckEx
DbgPrint
IofCompleteRequest
hal
KeGetCurrentIrql
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1022B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ