Static task
static1
Behavioral task
behavioral1
Sample
dfd0b1d011bd62b0f7a1124bdc0e7606132ca51f3f0f3ff2216e5bbe0016edcb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dfd0b1d011bd62b0f7a1124bdc0e7606132ca51f3f0f3ff2216e5bbe0016edcb.exe
Resource
win10v2004-20220812-en
General
-
Target
dfd0b1d011bd62b0f7a1124bdc0e7606132ca51f3f0f3ff2216e5bbe0016edcb
-
Size
4KB
-
MD5
58ae4072f3c2a7e19f43d63a022dedb1
-
SHA1
19494b8479d7939c4ebefb91b8ab3181ad7e8791
-
SHA256
dfd0b1d011bd62b0f7a1124bdc0e7606132ca51f3f0f3ff2216e5bbe0016edcb
-
SHA512
0b59c85712ee02758196096348596bbb316ecf0ef44a7f0c2222c1ba016499eb72d16e185f857c5215ac7e320d22864386eac84c16bbdb2eff1c8828215b5a9d
-
SSDEEP
48:q/w+lSotTVOL152I/d/NwXgfsnKf4r8iSszn+8mNa5zTiA8cHclWFgiLE67R/Tgl:ozVNI1RfsnKdIn+VNatWAOopLZ2h9
Malware Config
Signatures
Files
-
dfd0b1d011bd62b0f7a1124bdc0e7606132ca51f3f0f3ff2216e5bbe0016edcb.exe windows x86
572ccbc86d6697b9d1d41c302e71209d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlGetVersion
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
IoDeleteDevice
MmIsAddressValid
ObfDereferenceObject
ObReferenceObjectByPointer
RtlInitUnicodeString
IoDeleteSymbolicLink
memset
MmMapLockedPagesSpecifyCache
PsLookupProcessByProcessId
memcpy
_aullshr
hal
KfRaiseIrql
READ_PORT_BUFFER_USHORT
HalGetBusData
WRITE_PORT_BUFFER_USHORT
KfLowerIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 224B - Virtual size: 215B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 384B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 592B - Virtual size: 582B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ