Static task
static1
General
-
Target
83075035fd2d02146a4e4fbaaf151348ca6a39140eeb438d193a18b5eefd11d4
-
Size
236KB
-
MD5
2c655430ce772297c4e19dc61bcc14f1
-
SHA1
865c3f9a029a6260ffaae56199e1b2075b0efade
-
SHA256
83075035fd2d02146a4e4fbaaf151348ca6a39140eeb438d193a18b5eefd11d4
-
SHA512
0b798bb524f0430564ac6e1a03f127b25a556d1801db2d6b53d063b5d9af063e94f6ff52ecd42aa67894ded73c2557c523df9154e21fa133404d03d848d41cd7
-
SSDEEP
6144:azyfSjYUcZvOuh4rIm1YMggaDYKzGeUbSAY98RuIb64RD5fUZDU3t7H1z2RItffP:aoWYUcbh4rIngaDY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83075035fd2d02146a4e4fbaaf151348ca6a39140eeb438d193a18b5eefd11d4
Files
-
83075035fd2d02146a4e4fbaaf151348ca6a39140eeb438d193a18b5eefd11d4.sys windows:6 windows x86
c169321c165d25e6ca14c5c772ce5603
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsRemoveLoadImageNotifyRoutine
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
KeSetEvent
KeWaitForSingleObject
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
InitSafeBootMode
KeGetCurrentThread
IoCreateFile
RtlFreeAnsiString
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
memmove
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
KeUnstackDetachProcess
KeStackAttachProcess
PsLookupProcessByProcessId
_stricmp
ZwSetInformationFile
ZwQueryInformationFile
ZwReadFile
ZwWriteFile
RtlRandomEx
KeTickCount
ZwCreateFile
ZwOpenFile
PsTerminateSystemThread
RtlAppendUnicodeStringToString
RtlUnicodeStringToAnsiString
KeInsertQueueApc
KeInitializeApc
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlImageDirectoryEntryToData
RtlImageNtHeader
PsThreadType
PsCreateSystemThread
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
ZwQueryValueKey
RtlCompareUnicodeString
IofCompleteRequest
KeLeaveCriticalRegion
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
ExAcquireResourceSharedLite
ExReleaseResourceLite
ObQueryNameString
MmGetSystemRoutineAddress
ObOpenObjectByPointer
ObfReferenceObject
MmIsAddressValid
RtlPrefixUnicodeString
IoGetCurrentProcess
MmUserProbeAddress
CmUnRegisterCallback
CmRegisterCallback
KeDelayExecutionThread
KeQueryTimeIncrement
_alldiv
_allmul
ZwClose
ZwOpenProcess
PsGetProcessInheritedFromUniqueProcessId
ProbeForWrite
ExRaiseDatatypeMisalignment
wcsncpy
RtlSetDaclSecurityDescriptor
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoRegisterShutdownNotification
KeQuerySystemTime
PsGetProcessCreateTimeQuadPart
RtlCopyUnicodeString
KeResetEvent
KeBugCheckEx
ObOpenObjectByName
ZwOpenKey
ZwCreateKey
RtlCompareMemory
RtlUnwind
ProbeForRead
PsGetCurrentThreadId
ExGetPreviousMode
ObReferenceObjectByHandle
ObfDereferenceObject
RtlEqualUnicodeString
RtlAppendUnicodeToString
KeInitializeEvent
memcpy
ZwQuerySystemInformation
ExDeleteResourceLite
RtlHashUnicodeString
ExInitializeResourceLite
ExFreePoolWithTag
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
KeNumberProcessors
FsRtlIsNameInExpression
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwEnumerateKey
ZwEnumerateValueKey
PsProcessType
PsLookupThreadByThreadId
IoGetDeviceObjectPointer
RtlQueryRegistryValues
KeAreApcsDisabled
ExRaiseStatus
IoVolumeDeviceToDosName
_wcsnicmp
RtlMultiByteToUnicodeN
RtlAssert
DbgPrint
PsIsThreadTerminating
_allshl
_aullshr
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
FsRtlDissectName
ZwQueryInformationProcess
PsGetCurrentProcessId
memset
ZwDeviceIoControlFile
ExAllocatePoolWithTag
hal
KfRaiseIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfLowerIrql
fltmgr.sys
FltDeletePushLock
FltCloseClientPort
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltStartFiltering
FltFreeSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltInitializePushLock
FltAcquirePushLockExclusive
FltAcquirePushLockShared
FltReleasePushLock
FltSendMessage
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ