Static task
static1
Behavioral task
behavioral1
Sample
5dde24fd85ca2f1a7f7ab6e4303c190166b95bc3577d5a22473e404de2ef6d6b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5dde24fd85ca2f1a7f7ab6e4303c190166b95bc3577d5a22473e404de2ef6d6b.exe
Resource
win10v2004-20220812-en
General
-
Target
5dde24fd85ca2f1a7f7ab6e4303c190166b95bc3577d5a22473e404de2ef6d6b
-
Size
37KB
-
MD5
6206070bd4e555d2537a12a36f0a53ef
-
SHA1
a8cd45237dcb52b786cdcabd61c566d210c3e461
-
SHA256
5dde24fd85ca2f1a7f7ab6e4303c190166b95bc3577d5a22473e404de2ef6d6b
-
SHA512
b6cc5564a09d7232503ade97462535edf0c5e34f214d017a228a4a14c80c6faf1aa9ce4cdce053b94863a1609f82c01260732d876972632149b0ab2a075f30fe
-
SSDEEP
768:KkG98YOzPQHcLL+jTiAcACmZPCCEPVIdb546sjixZKHROycZH:KkGOzo8fRAr4CENoZsEeROycZ
Malware Config
Signatures
Files
-
5dde24fd85ca2f1a7f7ab6e4303c190166b95bc3577d5a22473e404de2ef6d6b.exe windows x86
9a3f9bcdc7d93bf6d3d72828e332842e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsstr
_wcslwr
ZwSetValueKey
ObReferenceObjectByHandle
swprintf
ZwClose
ZwOpenKey
RtlInitUnicodeString
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
strncpy
IoGetCurrentProcess
KeTickCount
KeQueryTimeIncrement
_stricmp
wcslen
KeQuerySystemTime
IofCompleteRequest
_snwprintf
wcsncpy
wcschr
_wcsicmp
wcsrchr
ZwQueryValueKey
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeDelayExecutionThread
MmGetSystemRoutineAddress
ZwDeleteKey
ZwCreateKey
wcscat
wcscpy
_snprintf
MmIsAddressValid
strncmp
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
PsCreateSystemThread
IoDeviceObjectType
_wcsnicmp
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 87B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ