Static task
static1
Behavioral task
behavioral1
Sample
820417042c47bb77f4aa256781506ea142208989954e1e4ce791f4d97d81658b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
820417042c47bb77f4aa256781506ea142208989954e1e4ce791f4d97d81658b.exe
Resource
win10v2004-20220812-en
General
-
Target
820417042c47bb77f4aa256781506ea142208989954e1e4ce791f4d97d81658b
-
Size
40KB
-
MD5
3bfe63d6e3952539f8b1eb6abca86ade
-
SHA1
55b8501793f73f9e4d1cbf17288ffa043cbd6adc
-
SHA256
820417042c47bb77f4aa256781506ea142208989954e1e4ce791f4d97d81658b
-
SHA512
8ffed7d86600dd58298459527843c13b1844dfb0dd3ec108ff2bf0726ead526f31ccc38a54f851e96c3911e66d9601b57d82e1f44fc3678befa2bc978e76eb7d
-
SSDEEP
768:ISLCun7TdPKsU0zFIBUVIVB1p6U4olntY147f5iXh/yvYlhf3SmhEJSjoVXMSurO:1LCm7TdPKsU0hVcB1p6mlnt24D2h/yvg
Malware Config
Signatures
Files
-
820417042c47bb77f4aa256781506ea142208989954e1e4ce791f4d97d81658b.exe windows x86
771729fc544508aca91d5551841b200d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncpy
PsLookupProcessByProcessId
_stricmp
RtlInitUnicodeString
ZwSetValueKey
IofCompleteRequest
_wcsnicmp
wcslen
RtlCompareUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
swprintf
wcscat
wcscpy
RtlAnsiStringToUnicodeString
wcsstr
_wcslwr
ZwCreateKey
PsCreateSystemThread
ZwSetInformationFile
ZwCreateFile
MmIsAddressValid
IoGetCurrentProcess
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExFreePool
_snprintf
ExAllocatePoolWithTag
_snwprintf
_wcsicmp
ObfDereferenceObject
IoDeviceObjectType
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
wcsncpy
wcschr
wcsrchr
ZwDeleteKey
PsGetVersion
RtlCopyUnicodeString
ObReferenceObjectByHandle
PsSetCreateProcessNotifyRoutine
KeQuerySystemTime
strncmp
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGECODE Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGERES Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 55B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ