Static task
static1
General
-
Target
WSDScan.zip
-
Size
11KB
-
MD5
d268ac1b764aa60d2c5078a1313dc995
-
SHA1
2109341ec7c4f3eb042954a709a0e8523c328d50
-
SHA256
1e47b40a01eaa4f0835b34bd15f8bf14bf59fe1dd227e42f4783f5935c2ced88
-
SHA512
9f395a5fec7d01366e198bacbc05fa38c3fd6308e3756ad26cef756cc3002641759be0d94dcf7136ed1fd43fd1a314ccd16e661a01a4d4ad4a64bc8d58abf6bb
-
SSDEEP
192:ygj+zhefK9DvKUGTgeFqjqDXqw9n8clyQj7DiWeJtVs1SSJiD3WXEBTQuFvaR:Rj+zhefKtKUwb38clljCWetquD3cwQCa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WSDScan.sys
Files
-
WSDScan.zip.zip
Password: test
-
WSDScan.sys.exe windows x64
Password: test
4abe8db7a23e1c9ce8d7be99a195a165
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
IoRegisterDeviceInterface
KeAcquireSpinLockRaiseToDpc
IoSetDeviceInterfaceState
IoDetachDevice
RtlFreeUnicodeString
RtlInitUnicodeString
KeInitializeSpinLock
IoOpenDeviceRegistryKey
IoDeleteDevice
RtlCopyUnicodeString
PoSetPowerState
IoGetDevicePropertyData
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
KeReleaseSpinLock
KeSetEvent
ExAllocatePool2
ExFreePool
KeClearEvent
IoGetDeviceProperty
MmGetSystemRoutineAddress
IoCreateDevice
IofCallDriver
IoWMIRegistrationControl
KeInitializeEvent
IofCompleteRequest
KeWaitForSingleObject
IoReleaseCancelSpinLock
ZwClose
ZwSetValueKey
ZwOpenKey
IoAllocateWorkItem
PoCallDriver
PoRequestPowerIrp
IoFreeWorkItem
IoQueueWorkItem
PoStartNextPowerIrp
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 562B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GFIDS Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ