Static task
static1
Behavioral task
behavioral1
Sample
8a04d3c0c67e54959722d058dbd85b1c3ec5bc8359dacfd3a5cc51f02513c896.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8a04d3c0c67e54959722d058dbd85b1c3ec5bc8359dacfd3a5cc51f02513c896.exe
Resource
win10v2004-20220812-en
General
-
Target
8a04d3c0c67e54959722d058dbd85b1c3ec5bc8359dacfd3a5cc51f02513c896
-
Size
37KB
-
MD5
fb9ca3a091cb1f773d1ac999347eca6e
-
SHA1
56d2329c23c179fe06cb7a978de104be0edd3e2d
-
SHA256
8a04d3c0c67e54959722d058dbd85b1c3ec5bc8359dacfd3a5cc51f02513c896
-
SHA512
e84159984c45949b1f7ccc8694af37f11bed0dd10601ae19da4ec1cba5582da258ac1395c7b8bd170945204db06df461ffca28fddf8feb53d8932387c0fd4949
-
SSDEEP
768:2jzDqHHRLrvn6MZVMeJiHZPJx4N/Xoz/X/WsIgnte0KBqiF6TbD:uWHxLTnr03HZPJEwDX/WszARBqo6
Malware Config
Signatures
Files
-
8a04d3c0c67e54959722d058dbd85b1c3ec5bc8359dacfd3a5cc51f02513c896.exe windows x86
5e0527945702cf1d6c4281e515b876d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsSetCreateProcessNotifyRoutine
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
strncmp
IoGetCurrentProcess
ZwDeleteKey
swprintf
ZwSetValueKey
ZwOpenKey
RtlInitUnicodeString
strncpy
KeQuerySystemTime
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
PsLookupProcessByProcessId
_stricmp
ZwCreateKey
ObReferenceObjectByHandle
wcsncpy
wcsrchr
PsCreateSystemThread
KeTickCount
KeQueryTimeIncrement
_snwprintf
RtlCopyUnicodeString
ZwQueryValueKey
_except_handler3
_wcsnicmp
wcscat
_wcsicmp
MmIsAddressValid
_snprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
wcschr
IoRegisterDriverReinitialization
wcsstr
_wcslwr
IoDeviceObjectType
MmGetSystemRoutineAddress
IofCompleteRequest
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 45B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ