Static task
static1
Behavioral task
behavioral1
Sample
899411ef7559ef5fdfa5707708ae60a503f5e24ff535b43a8b952972b63f1043.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
899411ef7559ef5fdfa5707708ae60a503f5e24ff535b43a8b952972b63f1043.exe
Resource
win10v2004-20221111-en
General
-
Target
899411ef7559ef5fdfa5707708ae60a503f5e24ff535b43a8b952972b63f1043
-
Size
37KB
-
MD5
fa9afc2b3f2d19d96a6a748df893f310
-
SHA1
087d76368520d225fb863b05f42e9c95dcdbb2ae
-
SHA256
899411ef7559ef5fdfa5707708ae60a503f5e24ff535b43a8b952972b63f1043
-
SHA512
ad9e78feecd87b95d2e89b8a15488c1e74f7670fe269dfa16d184358d4e2f1b271ee672d40a9dbe432ed476209e814c981687c504a62b414607daaf779a99291
-
SSDEEP
768:I2meYF+Dy/RxXCg5EVCdLVAtCMbDFXRySvVZj5bIXitXiJh:IqYF+O/RXEYdLVOCMvFhrvr1bP+h
Malware Config
Signatures
Files
-
899411ef7559ef5fdfa5707708ae60a503f5e24ff535b43a8b952972b63f1043.exe windows x86
c46b59689adf5a20d0b31713d0d991b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncpy
PsLookupProcessByProcessId
_stricmp
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
KeDelayExecutionThread
KeQuerySystemTime
MmIsAddressValid
MmGetSystemRoutineAddress
RtlCompareUnicodeString
wcsstr
_wcslwr
wcslen
wcscat
wcscpy
_wcsicmp
IoDeviceObjectType
_wcsnicmp
ObfDereferenceObject
ObReferenceObjectByHandle
PsCreateSystemThread
swprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetInformationFile
ZwCreateFile
IoRegisterDriverReinitialization
_snwprintf
wcsncpy
wcschr
wcsrchr
ZwDeleteKey
strncmp
IoGetCurrentProcess
ZwCreateKey
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
ExFreePool
_snprintf
ExAllocatePoolWithTag
KeTickCount
KeQueryTimeIncrement
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 71B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ