Static task
static1
Behavioral task
behavioral1
Sample
85afda74bd3f5b347dcb9ee7f3d80d66c73ad3da1a0228a1ba96c94ca52138d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85afda74bd3f5b347dcb9ee7f3d80d66c73ad3da1a0228a1ba96c94ca52138d2.exe
Resource
win10v2004-20221111-en
General
-
Target
85afda74bd3f5b347dcb9ee7f3d80d66c73ad3da1a0228a1ba96c94ca52138d2
-
Size
32KB
-
MD5
a59720600c0453294cd76fedc987cabf
-
SHA1
f945f3e5b021ee33e5826e0d5e0c6f9a4baac93a
-
SHA256
85afda74bd3f5b347dcb9ee7f3d80d66c73ad3da1a0228a1ba96c94ca52138d2
-
SHA512
9d4d571d647a9d42733a393fcba7a686a7c33bcacdc62c5560df67835a6cf08d3785a3c69f646fd6871f1229d33bf2c07e63f53bec8f4a706823edb19c68bb45
-
SSDEEP
384:lGvz9P+L2XytjWqtfXwqmH1famxDrqMLqgysyTDE4VndjyXNgM0n:lG1S2cjNfXS1fhqMLWkgnYXNgM0
Malware Config
Signatures
Files
-
85afda74bd3f5b347dcb9ee7f3d80d66c73ad3da1a0228a1ba96c94ca52138d2.exe windows x86
7de67cc73a2b1bff17e9bbc4d60f6e9f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlGetElementGenericTable
ExAllocatePool
ZwSetSecurityObject
RtlFreeUnicodeString
RtlImageNtHeader
KeRestoreFloatingPointState
ZwDuplicateObject
DbgPrompt
_strlwr
strcpy
CcGetLsnForFileObject
ObfReferenceObject
DbgPrintReturnControlC
KeSaveStateForHibernate
RtlInitString
_allshl
ExFreePool
strcmp
ZwQueryInformationProcess
MmFreePagesFromMdl
FsRtlCurrentBatchOplock
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
ExNotifyCallback
ZwLoadKey
FsRtlCheckLockForWriteAccess
KeQueryTimeIncrement
IoCreateSynchronizationEvent
KeQuerySystemTime
ZwDisplayString
HalDispatchTable
PsReturnPoolQuota
ObMakeTemporaryObject
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_READ
.mdata Size: 1024B - Virtual size: 772B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 42B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ