Static task
static1
General
-
Target
87900578945c492dfd3d436cf1d5c2e1bcf3292aa7f50efdb3b29e4d4dce92a4
-
Size
170KB
-
MD5
232c8e5e6df7c056714dfbc8eac41bba
-
SHA1
ddcb4d2b1954971a8bcf6adb3696d4083d4bcf98
-
SHA256
87900578945c492dfd3d436cf1d5c2e1bcf3292aa7f50efdb3b29e4d4dce92a4
-
SHA512
3af88d55c69811d68f1b16a3ffa3c351128eda6441a45927edd757d43e34c2f0d6d6eee0bf00b47d264e0cca0fdf09999b4bf31a54ee4398b03dc56d454ecbe3
-
SSDEEP
3072:qF6GUMiFRr7reCERDf/K4HnO001BlxDGLqy7+VsXzXqSHkhu:vxv1CDf/KAExDrSHM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87900578945c492dfd3d436cf1d5c2e1bcf3292aa7f50efdb3b29e4d4dce92a4
Files
-
87900578945c492dfd3d436cf1d5c2e1bcf3292aa7f50efdb3b29e4d4dce92a4.sys windows:6 windows x86
0b22f99d1e90170f9e05a58208fbf3c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeEnterCriticalRegion
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
ObfDereferenceObject
PsLookupProcessByProcessId
memset
MmGetSystemRoutineAddress
KeInitializeEvent
ExInitializeNPagedLookasideList
KeDelayExecutionThread
KeSetEvent
_vsnwprintf
ExAllocatePoolWithTag
RtlEqualUnicodeString
RtlMultiByteToUnicodeN
PsTerminateSystemThread
KeWaitForSingleObject
RtlCopyUnicodeString
MmIsAddressValid
ZwClose
PsGetCurrentProcessId
ObQueryNameString
ExInitializeRundownProtection
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
_wcsnicmp
ZwTerminateProcess
ZwOpenProcess
PsCreateSystemThread
ExReleaseResourceLite
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
ExAcquireResourceSharedLite
RtlInitializeGenericTableAvl
ExInitializePagedLookasideList
ExInitializeResourceLite
memcpy
KeRegisterBugCheckReasonCallback
ExUuidCreate
ExGetPreviousMode
RtlImageNtHeader
RtlCompareUnicodeString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwQuerySystemInformation
ZwQueryInformationFile
ZwOpenFile
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IofCompleteRequest
ZwCreateFile
ObReferenceObjectByHandle
IoFileObjectType
KeGetCurrentThread
ZwWriteFile
ZwDeleteFile
RtlAppendUnicodeStringToString
IoCreateDevice
MmUserProbeAddress
MmHighestUserAddress
KeLeaveCriticalRegion
KeTickCount
KeBugCheckEx
RtlUnwind
ExAcquireRundownProtection
ExAcquireRundownProtectionEx
ExReleaseRundownProtectionEx
InterlockedPushEntrySList
InterlockedPopEntrySList
InitSafeBootMode
IoDeleteDevice
IoRegisterShutdownNotification
IoCreateSymbolicLink
RtlAppendUnicodeToString
ExFreePoolWithTag
IoRegisterDriverReinitialization
FsRtlIsNameInExpression
IoGetDeviceObjectPointer
ZwDeleteKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
RtlGetVersion
ZwQueryInformationProcess
ObOpenObjectByPointer
PsProcessType
KeUnstackDetachProcess
KeStackAttachProcess
PsThreadType
PsIsThreadTerminating
MmUnmapLockedPages
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
KeInsertQueueApc
KeInitializeApc
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
IoGetDeviceAttachmentBaseRef
IoGetRelatedDeviceObject
ZwReadFile
IoCreateFileSpecifyDeviceObjectHint
ZwSetInformationFile
ZwQueryDirectoryFile
memmove
RtlCompareMemory
ZwCreateKey
ZwSetInformationObject
ZwQueryObject
IoAllocateIrp
IoGetBaseFileSystemDeviceObject
IoFreeIrp
IoCreateFile
ZwDuplicateObject
RtlQueryRegistryValues
KeAreApcsDisabled
ExRaiseStatus
IoVolumeDeviceToDosName
_strnicmp
_allshr
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
FsRtlDissectName
RtlCaptureStackBackTrace
RtlInitUnicodeString
RtlPrefixUnicodeString
IoRegisterBootDriverReinitialization
hal
KeGetCurrentIrql
KfLowerIrql
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
fltmgr.sys
FltAcquirePushLockShared
FltInitializePushLock
FltAcquirePushLockExclusive
FltReleasePushLock
FltDeletePushLock
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ