Static task
static1
General
-
Target
c860d08e27f67fa7ca85ff9132728540_native.exe
-
Size
107KB
-
MD5
c860d08e27f67fa7ca85ff9132728540
-
SHA1
9e1bff47b973bd145d3c565671560bc84c4c7320
-
SHA256
51e6a70dc087019f010618c05557c0077a8566eabdfa7658751a44e0917ee0c3
-
SHA512
eba456c0bb8962686d5ace8a4c74bc77b7576ebc026329b098cfced1f34ada4cd318973692817b65479a72c2edec9ebcb4b2cb2036fb3668e556d833dc8454cc
-
SSDEEP
1536:3egtPmzYAevUGYmjh40AJTHeL0t8pDEhnoi2ElfNG6Hyw4XxTmVd4l:usmovHYOhdAJTHG0tZ5oi2EbGfw4Xwal
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c860d08e27f67fa7ca85ff9132728540_native.exe
Files
-
c860d08e27f67fa7ca85ff9132728540_native.exe.sys windows:6 windows x86
201bc53dfdfe87e6e449ab2a4d46bd86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
memset
IoReuseIrp
RtlSubtreePredecessor
IoRemoveShareAccess
IoCheckEaBufferValidity
RtlCopyUnicodeString
RtlUnicodeStringToInteger
RtlGenerate8dot3Name
RtlInitUnicodeString
MmAllocateMappingAddress
RtlCopyString
FsRtlRegisterFileSystemFilterCallbacks
RtlSubtreeSuccessor
IoCheckQuerySetVolumeInformation
IoSetHardErrorOrVerifyDevice
FsRtlMdlWriteCompleteDev
KeInitializeTimer
RtlLookupElementGenericTableAvl
IoSetShareAccess
SeAuditingFileEvents
MmProtectMdlSystemAddress
IoWMIRegistrationControl
FsRtlCurrentBatchOplock
RtlIsGenericTableEmptyAvl
RtlEqualString
ExAllocatePoolWithTag
RtlDeleteElementGenericTableAvl
RtlFindMostSignificantBit
IoCsqInitialize
ExQueryPoolBlockSize
ExFreePoolWithTag
KeInitializeTimerEx
RtlTimeFieldsToTime
RtlFillMemoryUlong
RtlCreateRegistryKey
FsRtlIsPagingFile
IoForwardIrpSynchronously
RtlGetVersion
KeTickCount
KeBugCheckEx
KeQueryActiveProcessors
memcpy
hal
READ_PORT_USHORT
Sections
.text Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ