Static task
static1
General
-
Target
cc3e9c696798512895ce8318a187560231725220d008d23e169b5c24c1318234
-
Size
13.5MB
-
MD5
67545af8d02fe35dba5ea43be169d40c
-
SHA1
258cfa8447b70124cba5c23d99cbf7832b1e6718
-
SHA256
cc3e9c696798512895ce8318a187560231725220d008d23e169b5c24c1318234
-
SHA512
6a10eaddf82a2e5355bfef2021749dd4f7ff7afb223d977e371322314f46cb620f894a90a809b3a040fcfc4458126bc412c3bf93b92ccf80a07d52e1969574ac
-
SSDEEP
393216:a/yGvq9POYnSw66L5zenDU7cFKNj+04EQ3hl:eyGGPOYSwjNig7c+4EQ3hl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cc3e9c696798512895ce8318a187560231725220d008d23e169b5c24c1318234
Files
-
cc3e9c696798512895ce8318a187560231725220d008d23e169b5c24c1318234.sys windows:10 windows x64
8adeccd4b983e715a489075275398eae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
fltmgr.sys
FltObjectDereference
FltEnumerateFilters
ndis.sys
NdisGetVersion
ksecdd.sys
SecLookupAccountSid
ntoskrnl.exe
ExFreePoolWithTag
ProbeForRead
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
ExGetPreviousMode
ObReferenceObjectByHandle
ObCloseHandle
ZwClose
MmGetPhysicalAddress
MmIsAddressValid
PsGetCurrentProcessId
RtlRandom
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
ObIsKernelHandle
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsLookupProcessThreadByCid
__C_specific_handler
CmKeyObjectType
IoFileObjectType
PsProcessType
PsThreadType
MmHighestUserAddress
MmSystemRangeStart
MmUserProbeAddress
PsInitialSystemProcess
IoDriverObjectType
IoDeviceObjectType
KeDelayExecutionThread
ExInitializeLookasideListEx
ExDeleteLookasideListEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
RtlPcToFileHeader
wcsrchr
_wcsicmp
_wcsnicmp
RtlUnicodeStringToInteger
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
IoAllocateIrp
IoAllocateMdl
IofCallDriver
IoCreateFile
IoFreeIrp
IoFreeMdl
IoGetDeviceObjectPointer
IoGetRelatedDeviceObject
ZwCreateFile
ZwOpenFile
ZwReadFile
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
RtlUpcaseUnicodeString
MmIsNonPagedSystemAddressValid
MmMapViewInSystemSpace
MmUnmapViewInSystemSpace
IoGetFileObjectGenericMapping
IoCreateFileSpecifyDeviceObjectHint
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
ObInsertObject
ZwQueryObject
ZwOpenDirectoryObject
_vsnwprintf
ObCreateObject
ObReferenceObjectByName
MmCreateSection
SeCreateAccessState
ZwQueryDirectoryObject
NtBuildNumber
DbgSetDebugPrintCallback
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
KeDeregisterNmiCallback
KeAcquireGuardedMutex
KeReleaseGuardedMutex
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ExAcquireFastMutex
ExReleaseFastMutex
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
ExWaitForRundownProtectionRelease
ExAcquireSpinLockSharedAtDpcLevel
ExAcquireSpinLockShared
ExReleaseSpinLockSharedFromDpcLevel
ExReleaseSpinLockShared
CmUnRegisterCallback
MmUnlockPagableImageSection
IoStopTimer
IoUnregisterContainerNotification
PoUnregisterPowerSettingCallback
RtlNumberGenericTableElementsAvl
RtlFreeAnsiString
SeUnregisterLogonSessionTerminatedRoutine
KeInitializeDpc
ExAllocatePoolWithTag
KeAreApcsDisabled
KeQueryActiveProcessorCountEx
PsIsSystemThread
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfReleasePushLock
KeGenericCallDpc
KeSignalCallDpcDone
KeSignalCallDpcSynchronize
KeReleaseMutex
ExDeletePagedLookasideList
RtlLengthSid
SeQueryAuthenticationIdToken
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
PsGetProcessSessionId
RtlFreeUnicodeString
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
KeAreAllApcsDisabled
ExRaiseStatus
ExQueueWorkItem
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
IoVolumeDeviceToDosName
ZwQueryVolumeInformationFile
ObQueryNameString
RtlInitAnsiStringEx
RtlAnsiStringToUnicodeString
RtlStringFromGUID
NtQueryInformationTransactionManager
NtQueryInformationTransaction
NtQueryInformationEnlistment
NtQueryInformationResourceManager
KeInitializeTimerEx
KeCancelTimer
KeSetTimerEx
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLockAtDpcLevel
KeReleaseInStackQueuedSpinLockFromDpcLevel
ExAcquireRundownProtection
ExReleaseRundownProtection
PsTerminateSystemThread
ZwTerminateProcess
NtQueryInformationToken
NtClose
SeLocateProcessImageName
PsIsThreadTerminating
PsLookupThreadByThreadId
ZwQueryVirtualMemory
ExEnumHandleTable
ExfUnblockPushLock
ObGetObjectType
MmMapViewOfSection
MmUnmapViewOfSection
KeQueryPrcbAddress
KeInsertQueueApc
KeInitializeApc
ZwQuerySection
PsReferenceProcessFilePointer
KdDebuggerEnabled
MmSectionObjectType
towupper
RtlHashUnicodeString
RtlFindNextForwardRunClear
KeFlushQueuedDpcs
KeInitializeMutex
KeRevertToUserAffinityThread
KeSetSystemAffinityThread
KeSetSystemGroupAffinityThread
KeRevertToUserGroupAffinityThread
KeIpiGenericCall
KeQueryTimeIncrement
KeQueryHighestNodeNumber
KeGetProcessorNumberFromIndex
ExAllocatePoolWithQuotaTag
ExInitializePagedLookasideList
ExSetTimerResolution
ExUnregisterCallback
MmSizeOfMdl
PsCreateSystemThread
PsGetVersion
RtlEnumerateGenericTableAvl
RtlWalkFrameChain
MmGetVirtualForPhysical
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetCurrentThreadId
RtlCaptureContext
PsGetProcessExitTime
ObMakeTemporaryObject
ZwQuerySystemInformation
ZwQueryInformationProcess
ZwQueryInformationThread
RtlLookupFunctionEntry
RtlVirtualUnwind
KeCapturePersistentThreadState
strncmp
_strnicmp
RtlInitAnsiString
MmAllocateContiguousMemory
MmFreeContiguousMemory
RtlCompareString
KeBugCheckEx
KeLeaveCriticalRegion
RtlUnicodeStringToAnsiString
ObfDereferenceObject
KeEnterCriticalRegion
KeGetCurrentIrql
ObfReferenceObject
RtlCompareMemory
MmLockPagableSectionByHandle
hal
KeStallExecutionProcessor
Sections
.text Size: 472KB - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.[}w Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sI: Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: 600KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.`?] Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.*u1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uiM Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 760B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE