Static task
static1
General
-
Target
ffc43fddf5f92b00103315c437dd5265ddbcf237cedd93416ac981ebc6e54ce9
-
Size
4.8MB
-
MD5
d6cc6475583b88114aab70cc62f18b8e
-
SHA1
2cbec0480550600cd9c499b3a83e0016bac20840
-
SHA256
ffc43fddf5f92b00103315c437dd5265ddbcf237cedd93416ac981ebc6e54ce9
-
SHA512
4776d7a2740efaed583930f0558ec9d493d5e8c52f0689b15fbe047029c9117a53a724441faef54f13c45aa0192fe2859b5e26284b5f501763b1f56bc12cea8b
-
SSDEEP
98304:On1AbG4E0WTsa6RQWkpSFi0Fy7pOAriUOUktuwVu/Z4SH07C:O1aELsqpkhpSwOz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffc43fddf5f92b00103315c437dd5265ddbcf237cedd93416ac981ebc6e54ce9
Files
-
ffc43fddf5f92b00103315c437dd5265ddbcf237cedd93416ac981ebc6e54ce9.sys windows:10 windows x64
b41fa681c5e831947f36f19f27502487
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
fltmgr.sys
FltUnregisterFilter
FltStartFiltering
FltRegisterFilter
ntoskrnl.exe
ExAllocatePool
ExFreePoolWithTag
PsCreateSystemThread
PsTerminateSystemThread
ZwCreateFile
ZwReadFile
ZwClose
PsGetCurrentProcessId
ZwTerminateProcess
ZwOpenProcess
__C_specific_handler
IoGetCurrentProcess
ObReferenceObjectByHandle
ObfDereferenceObject
NtBuildNumber
DbgPrint
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwWriteFile
_snprintf
_vsnprintf
RtlCompareUnicodeStrings
strcmp
strncmp
RtlCompareMemory
RtlImageNtHeader
RtlCompareUnicodeString
ExAllocatePoolWithTag
isupper
isdigit
tolower
_stricmp
strstr
wcscat
wcslen
RtlInitAnsiString
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutineEx
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessPeb
PsGetProcessSessionId
RtlCreateRegistryKey
_vsnwprintf
RtlRandomEx
KeBugCheckEx
strlen
RtlInitUnicodeString
ZwQueryInformationFile
_stricmp
NtQuerySystemInformation
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
ZwWaitForSingleObject
ZwDeviceIoControlFile
ZwOpenFile
_wcsnicmp
ZwEnumerateKey
ZwCreateEvent
MmGetSystemRoutineAddress
ZwCreateFile
__C_specific_handler
KeSetSystemAffinityThread
KeQueryActiveProcessors
KeQueryTimeIncrement
DbgBreakPointWithStatus
RtlTimeToTimeFields
ExSystemTimeToLocalTime
IoAllocateMdl
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
KeWaitForSingleObject
KeReleaseMutex
KeInitializeMutex
ExFreePoolWithTag
ExAllocatePool
KeRevertToUserAffinityThread
DbgPrint
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
hal
KeQueryPerformanceCounter
KeQueryPerformanceCounter
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 516KB - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gg0 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gg1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gg2 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 608B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.l1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE