Static task
static1
Behavioral task
behavioral1
Sample
8a8695ee0717da13279ea0793ce5797e3cd0e6ceba8f0e877ea364bdbf5b9af8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8a8695ee0717da13279ea0793ce5797e3cd0e6ceba8f0e877ea364bdbf5b9af8.exe
Resource
win10v2004-20221111-en
General
-
Target
8a8695ee0717da13279ea0793ce5797e3cd0e6ceba8f0e877ea364bdbf5b9af8
-
Size
14KB
-
MD5
3cc3db9a6d22eafd615c49529a7bcde9
-
SHA1
58a69fe42ab325c0ace2435f16bcb453144755a4
-
SHA256
8a8695ee0717da13279ea0793ce5797e3cd0e6ceba8f0e877ea364bdbf5b9af8
-
SHA512
ae36c05f5efd5c58accf03e29f8576915ce2a0d5b4d9c1b31e6e88c1cc8af132ca35f4ab5b2894707e5b723178d4c544781a913898682aaecf95076d72fb2c4c
-
SSDEEP
192:xBClR4RZ3yEShZyL4Cp0pA4RRse7ezHa6YYkYzgYen/YU6xKY1BYUsJDLsYUCiDD:6OonwxZIBJZs
Malware Config
Signatures
Files
-
8a8695ee0717da13279ea0793ce5797e3cd0e6ceba8f0e877ea364bdbf5b9af8.exe windows x86
0d1098211f016ff7c1bc58a866ca4ff0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
ZwClose
ExFreePoolWithTag
_strnicmp
ExAllocatePoolWithTag
ZwQuerySystemInformation
IofCompleteRequest
IoDeleteDevice
MmIsAddressValid
ZwReadFile
ObfDereferenceObject
IoCreateFile
ObReferenceObjectByName
IoDriverObjectType
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
IoDeleteSymbolicLink
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 384B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 694B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ