Static task
static1
Behavioral task
behavioral1
Sample
bba943a48df021242b0204707f82339359e1a60bd749745169fb4e41d5c49dc5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bba943a48df021242b0204707f82339359e1a60bd749745169fb4e41d5c49dc5.exe
Resource
win10v2004-20221111-en
General
-
Target
bba943a48df021242b0204707f82339359e1a60bd749745169fb4e41d5c49dc5
-
Size
48KB
-
MD5
a891e6d7dad528a48048433a77ae55a1
-
SHA1
fabae3d0a05eafaca9a61b3a495fc1968eb94371
-
SHA256
bba943a48df021242b0204707f82339359e1a60bd749745169fb4e41d5c49dc5
-
SHA512
1a5621b981dd17d2a5bb74857ec4b9c04727233951ff1c1475c4c7db5747a5aac1e68e872b17ed1cc7115ec5a1422bb266327d679301ed8e307373fe612ac683
-
SSDEEP
768:gtXdBuy6Iy+o9AuJplTcSN46Q7JdrBb3g8ICA:gxdcyYHplTfeddrBbVd
Malware Config
Signatures
Files
-
bba943a48df021242b0204707f82339359e1a60bd749745169fb4e41d5c49dc5.exe windows x86
98fb13f1840cf5dd07dec37ad750c295
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcscat
wcscpy
ExAllocatePoolWithTag
wcslen
ZwClose
ZwCreateFile
RtlInitUnicodeString
wcsrchr
memcpy
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoCreateDevice
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
swprintf
_strnicmp
IoGetCurrentProcess
strlen
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoDeleteDevice
IoCreateSymbolicLink
KeQuerySystemTime
ZwSetValueKey
ZwDeviceIoControlFile
IoDeleteSymbolicLink
ExFreePool
PsGetCurrentProcessId
_stricmp
PsLookupProcessByProcessId
PsGetCurrentThreadId
InterlockedExchange
_wcsnicmp
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
KeServiceDescriptorTable
ZwOpenKey
ZwEnumerateKey
MmGetSystemRoutineAddress
memset
IoDetachDevice
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
RtlCopyUnicodeString
IofCallDriver
KeGetCurrentThread
IoAllocateIrp
IoFreeIrp
ObQueryNameString
memmove
KeUnstackDetachProcess
sprintf
ZwAllocateVirtualMemory
KeStackAttachProcess
ObOpenObjectByPointer
PsProcessType
ZwDeleteKey
ZwSetInformationFile
ZwWriteFile
ZwCreateKey
ZwQueryValueKey
ZwReadFile
ZwQueryInformationFile
wcsstr
wcschr
IofCompleteRequest
MmUnmapIoSpace
MmMapIoSpace
strcpy
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ