Static task
static1
General
-
Target
69137dd28fe9dcf8125f177eaa28bf7ddc87ebbffb45c8c69548757dc94130b5
-
Size
6.9MB
-
MD5
4c86e4b3a27655cea325d6909cb8a816
-
SHA1
22c150fce0896a11874e28daa9aafb7e7095fd1e
-
SHA256
69137dd28fe9dcf8125f177eaa28bf7ddc87ebbffb45c8c69548757dc94130b5
-
SHA512
e84ae5d4553d45a715a4e009484324a6bd3a18f542f5ae36b72a80bf062c533cb36bf3441d2b56b43758d4e0bf9d036c30e90c6b2131c33bf7c4a0b6fda555bd
-
SSDEEP
196608:zDU7cZbn+9q3ey521NjdkBru+yXoEuJLb6KSDsu:zDU7cFKNj+04EQ3hl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 69137dd28fe9dcf8125f177eaa28bf7ddc87ebbffb45c8c69548757dc94130b5
Files
-
69137dd28fe9dcf8125f177eaa28bf7ddc87ebbffb45c8c69548757dc94130b5.sys windows:10 windows x64
e3dee97d4282ee557745b88024839ce2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
fltmgr.sys
FltObjectDereference
ndis.sys
NdisGetVersion
ksecdd.sys
SecLookupAccountSid
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
hal
KeStallExecutionProcessor
KeQueryPerformanceCounter
Sections
.text Size: - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.[}w Size: - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sI: Size: - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.`?] Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.*u1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uiM Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ