Static task
static1
Behavioral task
behavioral1
Sample
61e80d53c40cb085319c33921f7aef014f118bb5f126c259ef1adcb3057f6e0f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
61e80d53c40cb085319c33921f7aef014f118bb5f126c259ef1adcb3057f6e0f.exe
Resource
win10v2004-20220812-en
General
-
Target
61e80d53c40cb085319c33921f7aef014f118bb5f126c259ef1adcb3057f6e0f
-
Size
25KB
-
MD5
1fef443b74e945d088bd41d0e5aba080
-
SHA1
da08a727bb993f4d34e3626bf17230c61d412e4d
-
SHA256
61e80d53c40cb085319c33921f7aef014f118bb5f126c259ef1adcb3057f6e0f
-
SHA512
2169b1aeedd54625d1d9109a0afc512560cb137f278ba6b1e293d1ab13896dc40bb5c9b0d17962f1620a71229a6632c4f0b3a49d65bbd7965b0f571498b7ee75
-
SSDEEP
768:z/8+740940940940940940940Z5Wum4ZTqv6urXTX2:r8dgTq68
Malware Config
Signatures
Files
-
61e80d53c40cb085319c33921f7aef014f118bb5f126c259ef1adcb3057f6e0f.exe windows x86
cd9acb7c3ec5a89486c0c1925c07b750
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwQuerySystemInformation
MmUserProbeAddress
ZwReadFile
ZwCreateFile
ZwQueryInformationProcess
ZwPulseEvent
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IoCreateDevice
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
strncmp
IoGetCurrentProcess
strrchr
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
ZwClose
IofCompleteRequest
_stricmp
IofCallDriver
_except_handler3
hal
KfLowerIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
Sections
qHrqwQt Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.t2ata Size: 256B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t1ata Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 992B - Virtual size: 966B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 928B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ