Static task
static1
Behavioral task
behavioral1
Sample
9a5bffd08014180a19c1afe94026c59265d03dcf43e23048e25df3c61d382df0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9a5bffd08014180a19c1afe94026c59265d03dcf43e23048e25df3c61d382df0.exe
Resource
win10v2004-20221111-en
General
-
Target
9a5bffd08014180a19c1afe94026c59265d03dcf43e23048e25df3c61d382df0
-
Size
39KB
-
MD5
67521695d19716a1b146fdf633f0de3e
-
SHA1
1f082b938cf07b201194dd813eb4a6c4b0e411b0
-
SHA256
9a5bffd08014180a19c1afe94026c59265d03dcf43e23048e25df3c61d382df0
-
SHA512
8ef37dc19df5382dec132410adb1f2e9ac8daa5e8d5839a0baa048dd991e3ed847b9fea0585a0b292f1c9234ba734a178db549dc8f6db27361fd7d9a2006cf64
-
SSDEEP
768:/c2IrxkXbVMCF70hdbGPHWMvHG/YQcPlmhKP1+tHLVyBmQKu5PGIX3:kdxkBMCuhdbFaH1QcUhwcrtC
Malware Config
Signatures
Files
-
9a5bffd08014180a19c1afe94026c59265d03dcf43e23048e25df3c61d382df0.exe windows x86
49abd00e3314a2f7a062b14c46557244
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_stricmp
swprintf
wcsstr
_wcslwr
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
IoRegisterDriverReinitialization
ZwDeleteKey
RtlCopyUnicodeString
PsCreateSystemThread
_wcsicmp
wcsncpy
wcslen
wcsrchr
MmIsAddressValid
strncpy
PsLookupProcessByProcessId
IoDeviceObjectType
ObReferenceObjectByHandle
_snwprintf
ExAllocatePoolWithTag
strncmp
IoGetCurrentProcess
ObfDereferenceObject
ZwSetInformationFile
ZwCreateFile
wcscpy
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeQueryTimeIncrement
_wcsnicmp
ZwCreateKey
KeQuerySystemTime
RtlCompareUnicodeString
PsGetVersion
ExFreePool
_snprintf
PsSetCreateProcessNotifyRoutine
KeDelayExecutionThread
wcschr
wcscat
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
IofCompleteRequest
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 78B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ