Static task
static1
Behavioral task
behavioral1
Sample
33380bfb75a58cc6d92619271ca68afb30294e05914e657fbbeec78052a6a691.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
33380bfb75a58cc6d92619271ca68afb30294e05914e657fbbeec78052a6a691.exe
Resource
win10v2004-20220901-en
General
-
Target
33380bfb75a58cc6d92619271ca68afb30294e05914e657fbbeec78052a6a691
-
Size
12KB
-
MD5
83fa0edc6671c295c4a34a9d1e6e1545
-
SHA1
9a72963768a1895dec9f44255b140675daaa9ed6
-
SHA256
33380bfb75a58cc6d92619271ca68afb30294e05914e657fbbeec78052a6a691
-
SHA512
83fa6d225572810d2d1f859a58472e4aa0e138e80e56a7c59040a4408356675662dcea1e98705b5fa492ce46b10de07ec61acd0a26ec0e49cd89138e0d6273aa
-
SSDEEP
192:3WCjEq2yQF6AMUTBbl+hWfpwfWZ8q1HaAtu33jBpk3dyKQxev:3WCvO6Gdl+gx5rtY3VC30nev
Malware Config
Signatures
Files
-
33380bfb75a58cc6d92619271ca68afb30294e05914e657fbbeec78052a6a691.exe windows x86
6f1c1a52434a78f0f2197f651ee5edc0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
memset
ObReferenceObjectByName
memcpy
IoDeleteSymbolicLink
_wcsnicmp
strlen
RtlInitUnicodeString
IoDeleteDevice
swprintf
RtlGetVersion
wcsrchr
ZwClose
IofCompleteRequest
MmMapLockedPagesSpecifyCache
IoCreateSymbolicLink
MmIsAddressValid
IoCreateDevice
wcscpy
PsGetCurrentThreadId
wcslen
ObReferenceObjectByHandle
ObfDereferenceObject
RtlMultiByteToUnicodeN
ZwOpenKey
IoGetCurrentProcess
ObReferenceObjectByPointer
PsGetThreadProcessId
ExFreePoolWithTag
KeServiceDescriptorTable
ExAllocatePoolWithTag
_except_handler3
hal
KfRaiseIrql
KfLowerIrql
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 576B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 864B - Virtual size: 850B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 768B - Virtual size: 754B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ