Static task
static1
Behavioral task
behavioral1
Sample
b6cb1fa1672a1330b753405174143c620606e9cabea4610c3369db293e1e967c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b6cb1fa1672a1330b753405174143c620606e9cabea4610c3369db293e1e967c.exe
Resource
win10v2004-20220812-en
General
-
Target
b6cb1fa1672a1330b753405174143c620606e9cabea4610c3369db293e1e967c
-
Size
9KB
-
MD5
b3403ad87b242c5bb5ce394e5a55750e
-
SHA1
ff20476f39bb90222e3452e0c93dfd2fe7b251c0
-
SHA256
b6cb1fa1672a1330b753405174143c620606e9cabea4610c3369db293e1e967c
-
SHA512
0997cf6b3bd6be7740ea4f476e9c3793e5c16262750a925024d9d1693d0990e8ae52db96a55e725bb2a7e52916f2f99447910cd5ef9a23c00c78527113ec6866
-
SSDEEP
96:d8YELpWtlnQeOOXJRbqhVMCrIL2InqKmAFkjHjMvMnIebixMB9/w5j555h15g5Ro:iYELEwUZarIaInquovaw44+Kl2q
Malware Config
Signatures
Files
-
b6cb1fa1672a1330b753405174143c620606e9cabea4610c3369db293e1e967c.exe windows x86
6d4682eb32b21cb9a680ac9eaab291cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePool
ExFreePool
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
KeCancelTimer
KeGetCurrentThread
KeInitializeTimerEx
KeQueryPriorityThread
KeSetPriorityThread
KeSetTimerEx
KeWaitForSingleObject
ObDereferenceObject
ObReferenceObjectByHandle
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
ZwCreateFile
ZwCreateKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwOpenFile
ZwOpenKey
ZwQueryDirectoryFile
ZwQueryKey
ZwQueryValueKey
ZwSetInformationFile
ZwSetValueKey
ZwWriteFile
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 992B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1006B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 288B - Virtual size: 258B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ