Static task
static1
General
-
Target
9d8fb5f964530a1f7a4abcf64da76b898f2859f776c8666212ea298848ab33b4
-
Size
236KB
-
MD5
b9c5d3f6ff1faa0c55a90c617d87555c
-
SHA1
e8169f046d6f6ba37189a74d12c49181ff0a938e
-
SHA256
9d8fb5f964530a1f7a4abcf64da76b898f2859f776c8666212ea298848ab33b4
-
SHA512
4b717e0d383e2161260a20a24fa2ce41e4d011697947b4041bc1447713b9ff7ff62bc209bded7f9cbf3ec1574736f2bee20c40d8e17dc0e8f238a217a56b115a
-
SSDEEP
6144:aryfSjYUcZvOuh4rIm1YMggaDYKzGeUbSAY98RuIb64RD5fUZDU3t7H1z2RItffm:agWYUcbh4rIngaDY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d8fb5f964530a1f7a4abcf64da76b898f2859f776c8666212ea298848ab33b4
Files
-
9d8fb5f964530a1f7a4abcf64da76b898f2859f776c8666212ea298848ab33b4.sys windows:6 windows x86
c169321c165d25e6ca14c5c772ce5603
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsRemoveLoadImageNotifyRoutine
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
KeSetEvent
KeWaitForSingleObject
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
InitSafeBootMode
KeGetCurrentThread
IoCreateFile
RtlFreeAnsiString
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
memmove
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
KeUnstackDetachProcess
KeStackAttachProcess
PsLookupProcessByProcessId
_stricmp
ZwSetInformationFile
ZwQueryInformationFile
ZwReadFile
ZwWriteFile
RtlRandomEx
KeTickCount
ZwCreateFile
ZwOpenFile
PsTerminateSystemThread
RtlAppendUnicodeStringToString
RtlUnicodeStringToAnsiString
KeInsertQueueApc
KeInitializeApc
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlImageDirectoryEntryToData
RtlImageNtHeader
PsThreadType
PsCreateSystemThread
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
ZwQueryValueKey
RtlCompareUnicodeString
IofCompleteRequest
KeLeaveCriticalRegion
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
ExAcquireResourceSharedLite
ExReleaseResourceLite
ObQueryNameString
MmGetSystemRoutineAddress
ObOpenObjectByPointer
ObfReferenceObject
MmIsAddressValid
RtlPrefixUnicodeString
IoGetCurrentProcess
MmUserProbeAddress
CmUnRegisterCallback
CmRegisterCallback
KeDelayExecutionThread
KeQueryTimeIncrement
_alldiv
_allmul
ZwClose
ZwOpenProcess
PsGetProcessInheritedFromUniqueProcessId
ProbeForWrite
ExRaiseDatatypeMisalignment
wcsncpy
RtlSetDaclSecurityDescriptor
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoRegisterShutdownNotification
KeQuerySystemTime
PsGetProcessCreateTimeQuadPart
RtlCopyUnicodeString
KeResetEvent
KeBugCheckEx
ObOpenObjectByName
ZwOpenKey
ZwCreateKey
RtlCompareMemory
RtlUnwind
ProbeForRead
PsGetCurrentThreadId
ExGetPreviousMode
ObReferenceObjectByHandle
ObfDereferenceObject
RtlEqualUnicodeString
RtlAppendUnicodeToString
KeInitializeEvent
memcpy
ZwQuerySystemInformation
ExDeleteResourceLite
RtlHashUnicodeString
ExInitializeResourceLite
ExFreePoolWithTag
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeNumberProcessors
FsRtlIsNameInExpression
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwEnumerateKey
ZwEnumerateValueKey
PsProcessType
PsLookupThreadByThreadId
IoGetDeviceObjectPointer
RtlQueryRegistryValues
KeAreApcsDisabled
ExRaiseStatus
IoVolumeDeviceToDosName
_wcsnicmp
RtlMultiByteToUnicodeN
RtlAssert
DbgPrint
PsIsThreadTerminating
_allshl
_aullshr
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
FsRtlDissectName
ZwQueryInformationProcess
PsGetCurrentProcessId
memset
ZwDeviceIoControlFile
ExAllocatePoolWithTag
hal
KfRaiseIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfLowerIrql
fltmgr.sys
FltDeletePushLock
FltCloseClientPort
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltStartFiltering
FltFreeSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltInitializePushLock
FltAcquirePushLockExclusive
FltAcquirePushLockShared
FltReleasePushLock
FltSendMessage
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ