Static task
static1
Behavioral task
behavioral1
Sample
8915a3fbe59c0a00f2051d9a60a2db3b4cb8c24603775371b9b60f211bbf2af6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8915a3fbe59c0a00f2051d9a60a2db3b4cb8c24603775371b9b60f211bbf2af6.exe
Resource
win10v2004-20221111-en
General
-
Target
8915a3fbe59c0a00f2051d9a60a2db3b4cb8c24603775371b9b60f211bbf2af6
-
Size
47KB
-
MD5
d355a579b6146697953759e0640461c6
-
SHA1
53b79d6e517abe4503c8d1e155e74d61c1c87c13
-
SHA256
8915a3fbe59c0a00f2051d9a60a2db3b4cb8c24603775371b9b60f211bbf2af6
-
SHA512
71c6bbd36058c281f92e9754f522cf28f2c8ec44097f34f2e295b8c0740c35b770b9331b12e9b90a0eec3b91bfcf831cabed5bb7074392d9c67c53debae9edeb
-
SSDEEP
384:zdRvBP28zqQFv2Gs/uWzFs3EIIIgvRgIBEUpdtdn8pMtL0QYWHt:ZXPLzRFOG8uWzC3iIUTXjf
Malware Config
Signatures
Files
-
8915a3fbe59c0a00f2051d9a60a2db3b4cb8c24603775371b9b60f211bbf2af6.exe windows x86
c43f7a7de46ddc5b0e2b27c1f7519ff4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
NtQueryInformationAtom
_allrem
RtlCreateAcl
IoInitializeIrp
IoRaiseInformationalHardError
PfxRemovePrefix
InterlockedIncrement
READ_REGISTER_UCHAR
RtlExtendedLargeIntegerDivide
FsRtlDoesNameContainWildCards
RtlSetDaclSecurityDescriptor
strrchr
InbvAcquireDisplayOwnership
ExInterlockedExchangeUlong
RtlRealPredecessor
PoShutdownBugCheck
KeAcquireSpinLockAtDpcLevel
RtlFindUnicodePrefix
KeSetTimerEx
RtlEqualUnicodeString
isprint
_strrev
MmLockPagableDataSection
PsRestoreImpersonation
SeAccessCheck
FsRtlNotifyFullChangeDirectory
PsAssignImpersonationToken
WRITE_REGISTER_BUFFER_UCHAR
ExCreateCallback
RtlUpcaseUnicodeStringToCountedOemString
MmIsDriverVerifying
ObDereferenceObject
IoStartTimer
ObReferenceObjectByName
Ke386CallBios
MmCanFileBeTruncated
ZwLoadKey
wcschr
KeDeregisterBugCheckCallback
LdrEnumResources
sprintf
FsRtlSyncVolumes
IoGetBaseFileSystemDeviceObject
FsRtlIsDbcsInExpression
RtlEnlargedIntegerMultiply
RtlAppendUnicodeStringToString
KeUnstackDetachProcess
_allshr
FsRtlIsNtstatusExpected
MmIsNonPagedSystemAddressValid
RtlNumberOfSetBits
RtlUnicodeStringToAnsiString
SeImpersonateClient
_local_unwind2
KeGetPreviousMode
towupper
RtlGetCallersAddress
CcRepinBcb
_abnormal_termination
ZwLoadKey
CcSetDirtyPageThreshold
NlsAnsiCodePage
MmSetAddressRangeModified
SeDeassignSecurity
MmForceSectionClosed
wcschr
IoFreeIrp
FsRtlIsDbcsInExpression
ExLocalTimeToSystemTime
ExFreePoolWithTag
ObMakeTemporaryObject
RtlLargeIntegerShiftLeft
ZwUnmapViewOfSection
IoAcquireRemoveLockEx
KeSetSystemAffinityThread
IoWMIWriteEvent
RtlIsRangeAvailable
RtlGetSaclSecurityDescriptor
ExAcquireResourceSharedLite
CcSetAdditionalCacheAttributes
IoGetStackLimits
KeResetEvent
RtlLargeIntegerSubtract
IoFileObjectType
FsRtlFastCheckLockForWrite
MmResetDriverPaging
ExReinitializeResourceLite
IoGetRelatedDeviceObject
ZwFlushKey
RtlGetGroupSecurityDescriptor
IoCreateNotificationEvent
NlsLeadByteInfo
RtlStringFromGUID
ExSystemExceptionFilter
ExReleaseResourceLite
WRITE_REGISTER_ULONG
KeI386AllocateGdtSelectors
NlsLeadByteInfo
ZwSetTimer
InbvResetDisplay
CcUnpinRepinnedBcb
IoUnregisterFileSystem
KiReleaseSpinLock
IoSetIoCompletion
KeNumberProcessors
PfxRemovePrefix
IoGetAttachedDevice
MmUnmapLockedPages
PsSetLegoNotifyRoutine
ZwAccessCheckAndAuditAlarm
strchr
ZwCreateEvent
RtlUpcaseUnicodeStringToAnsiString
IoGetFileObjectGenericMapping
RtlLargeIntegerShiftRight
wcsncat
FsRtlOplockFsctrl
IoUnregisterShutdownNotification
_wcslwr
CcUnpinRepinnedBcb
ZwQueryDirectoryObject
NtWriteFile
KeRemoveEntryDeviceQueue
ZwQueryValueKey
FsRtlNormalizeNtstatus
RtlValidRelativeSecurityDescriptor
ExInitializeZone
ZwRequestWaitReplyPort
RtlImageDirectoryEntryToData
MmFlushImageSection
_wcsnicmp
IoConnectInterrupt
ZwSetSecurityObject
KeAcquireSpinLockAtDpcLevel
RtlUnicodeStringToInteger
Exfi386InterlockedExchangeUlong
IoIsOperationSynchronous
IoDisconnectInterrupt
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 128B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ