Static task
static1
Behavioral task
behavioral1
Sample
a6d2140d31bd937dafc85d22b9eb636967673f2661bdffb9ba8007c82732750c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a6d2140d31bd937dafc85d22b9eb636967673f2661bdffb9ba8007c82732750c.exe
Resource
win10v2004-20220812-en
General
-
Target
a6d2140d31bd937dafc85d22b9eb636967673f2661bdffb9ba8007c82732750c
-
Size
4KB
-
MD5
6700e0f3016f4451ade4c996e0838000
-
SHA1
45b85ce11931c8b03f9e51a13ea47d368b5888e9
-
SHA256
a6d2140d31bd937dafc85d22b9eb636967673f2661bdffb9ba8007c82732750c
-
SHA512
adeffe4ed816d9e3eeaf3b17511a4ed5ce6dd36d40b6e026286f8752061fea9cd9b07f7cc95998f6eaf297b2ecc8af2ac4bd39b9ba6295ee6feeb740a6a6d59d
-
SSDEEP
96:b0HsVBI59niMkbMsnKdwbbMjx9NLZ2hK:b0HnltBd0MjyhK
Malware Config
Signatures
Files
-
a6d2140d31bd937dafc85d22b9eb636967673f2661bdffb9ba8007c82732750c.exe windows x86
509f5d610881d0ca69b0265025ac00fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlGetVersion
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
IoDeleteDevice
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByPointer
RtlInitUnicodeString
IoDeleteSymbolicLink
memset
MmMapLockedPagesSpecifyCache
PsLookupProcessByProcessId
memcpy
_aullshr
_except_handler3
hal
KfRaiseIrql
READ_PORT_BUFFER_USHORT
HalGetBusData
WRITE_PORT_BUFFER_USHORT
KfLowerIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 336B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 400B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 608B - Virtual size: 606B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 208B - Virtual size: 202B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ