Static task
static1
General
-
Target
4e17307df07addde84d57e42fe02c35aa8c1d5d43ac8c003a158740f3d4b7147
-
Size
288KB
-
MD5
b8d08293f7f3f6929a00e7b22dbc7182
-
SHA1
1b9e7aca6e6980ed9733d982be9c48ddf0ec7869
-
SHA256
4e17307df07addde84d57e42fe02c35aa8c1d5d43ac8c003a158740f3d4b7147
-
SHA512
ca8984c552c77794774df5122d6b053fd08c8156df63ad8bc3dbd81506e3e9b27bc761521544788eb1f81a962123fb946a8da5bb2f70cb39d3a72b23af254ed2
-
SSDEEP
3072:0VuXntr21aKOQBUEWpO1oZ/Y1ZvSQFoXFDGQVfNZX1y95Nlvo5l17THK5jjuwr+8:0odr2JOQ+h8HvSOoXFDDVr1Wlvo6+Je
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e17307df07addde84d57e42fe02c35aa8c1d5d43ac8c003a158740f3d4b7147
Files
-
4e17307df07addde84d57e42fe02c35aa8c1d5d43ac8c003a158740f3d4b7147.sys windows:6 windows x64
3377d21a47207189919eb3de5cdb6a80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
ZwOpenKey
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsRemoveLoadImageNotifyRoutine
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
ExDeletePagedLookasideList
ExQueryDepthSList
ExInitializePagedLookasideList
KeSetEvent
KeWaitForSingleObject
IoDeleteSymbolicLink
IoDeleteDevice
InitSafeBootMode
IoCreateSymbolicLink
IoCreateDevice
MmUnmapLockedPages
_stricmp
ProbeForRead
RtlAnsiStringToUnicodeString
PsLookupProcessByProcessId
ZwReadFile
KeInitializeApc
KeInsertQueueApc
IoCreateFile
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoIs32bitProcess
MmProtectMdlSystemAddress
RtlEqualUnicodeString
IoFreeMdl
KeUnstackDetachProcess
RtlImageDirectoryEntryToData
ZwSetInformationFile
RtlFreeUnicodeString
ZwCreateFile
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ZwFreeVirtualMemory
RtlRandomEx
RtlAppendUnicodeStringToString
RtlFreeAnsiString
MmProbeAndLockPages
PsThreadType
RtlCompareMemory
MmUnlockPages
ZwQueryInformationProcess
ZwOpenFile
RtlImageNtHeader
ZwQueryInformationFile
ZwWriteFile
KeStackAttachProcess
IoAllocateMdl
ZwAllocateVirtualMemory
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
ZwQueryValueKey
RtlCompareUnicodeString
ExAcquireResourceExclusiveLite
KeLeaveCriticalRegion
ExGetPreviousMode
MmGetSystemRoutineAddress
KeEnterCriticalRegion
ObQueryNameString
ExAcquireResourceSharedLite
IoGetCurrentProcess
ExReleaseResourceLite
ObfDereferenceObject
IofCompleteRequest
ZwDeviceIoControlFile
ObfReferenceObject
MmIsAddressValid
ObOpenObjectByPointer
CmRegisterCallbackEx
_vsnwprintf
CmUnRegisterCallback
KeDelayExecutionThread
KeQueryTimeIncrement
ProbeForWrite
PsGetProcessInheritedFromUniqueProcessId
ZwOpenProcess
PsGetProcessWow64Process
MmSystemRangeStart
wcsncpy
RtlSetDaclSecurityDescriptor
ExUnregisterCallback
IoRegisterShutdownNotification
ExRegisterCallback
ExCreateCallback
PsGetProcessCreateTimeQuadPart
MmUserProbeAddress
RtlCopyUnicodeString
KeResetEvent
KeBugCheckEx
PsGetCurrentThreadId
ObReferenceObjectByHandle
ZwClose
RtlInitUnicodeString
ObOpenObjectByName
ZwCreateKey
KeInitializeEvent
RtlAppendUnicodeToString
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeResourceLite
ExDeleteResourceLite
RtlHashUnicodeString
ZwQuerySystemInformation
ZwEnumerateValueKey
ZwEnumerateKey
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwCreateSection
FsRtlIsNameInExpression
towupper
PsProcessType
IoGetTopLevelIrp
PsLookupThreadByThreadId
IoGetDeviceObjectPointer
ExRaiseStatus
KeAreApcsDisabled
_wcsnicmp
RtlQueryRegistryValues
IoVolumeDeviceToDosName
DbgPrint
PsIsThreadTerminating
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
FsRtlDissectName
ExFreePoolWithTag
RtlPrefixUnicodeString
ExAllocatePoolWithTag
__C_specific_handler
fltmgr.sys
FltDeletePushLock
FltGetFileNameInformationUnsafe
FltCloseClientPort
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltFreeSecurityDescriptor
FltCreateCommunicationPort
FltAcquirePushLockExclusive
FltInitializePushLock
FltReleasePushLock
FltAcquirePushLockShared
FltSendMessage
FltReleaseFileNameInformation
Sections
.text Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ