Static task
static1
General
-
Target
5c1f72bf7fc67a54d69220d40c42dd60_native.exe
-
Size
315KB
-
MD5
5c1f72bf7fc67a54d69220d40c42dd60
-
SHA1
cbab19d864d3de4e6437b9171cbe1324635d7fac
-
SHA256
39b77017a83d7818c4911df3a0539c7b113f0de9be6bdaf49f75709cb6a54ae2
-
SHA512
82b65acd40c78b0d3145e6fc201accaa86b29defbc5ae3dd472244cd4920d4cd2c635cd405fc83cb52c36ddaf8c732c1b8db7de688282d4db875498ba7d9234f
-
SSDEEP
3072:bhU65QHiLtTPKS6qupEFFWfS8EKkSzMjd67pK/LanRjQxbz28J:bq8QSPKfqFrfAgjd64YZy2s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c1f72bf7fc67a54d69220d40c42dd60_native.exe
Files
-
5c1f72bf7fc67a54d69220d40c42dd60_native.exe.sys windows:4 windows x86
7348bfc385d8de37a51bbec7fbe24e16
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwEnumerateKey
ZwQueryValueKey
ZwOpenKey
MmUnlockPages
MmProbeAndLockPages
RtlUnicodeStringToInteger
DbgPrint
KeSynchronizeExecution
ZwQueryInformationFile
ZwCreateFile
IoFreeMdl
RtlWriteRegistryValue
ZwOpenSymbolicLinkObject
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoConnectInterrupt
MmMapIoSpace
_wcsicmp
RtlInitUnicodeString
KeInitializeTimer
KeInitializeDpc
IoDisconnectInterrupt
IoUnregisterShutdownNotification
MmUnmapIoSpace
ZwDeleteKey
ZwClose
ExAllocatePoolWithTag
ExFreePool
KeInitializeMutex
ZwReadFile
MmCreateMdl
KeInitializeSpinLock
MmMapLockedPages
IoQueryDeviceDescription
IoReportResourceUsage
IoDeleteDevice
IoDeleteSymbolicLink
wcslen
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
IoCreateSymbolicLink
IoCreateDevice
RtlExtendedIntegerMultiply
KeQuerySystemTime
RtlExtendedLargeIntegerDivide
IoReleaseCancelSpinLock
InterlockedExchange
IoAcquireCancelSpinLock
ZwSetValueKey
MmBuildMdlForNonPagedPool
IoAllocateMdl
KeSetEvent
KeResetEvent
IoAllocateAdapterChannel
KeInitializeEvent
ExQueueWorkItem
InterlockedDecrement
InterlockedIncrement
IoSetShareAccess
ZwCreateKey
RtlUnwind
RtlQueryRegistryValues
IoRegisterShutdownNotification
KeCancelTimer
KeWaitForSingleObject
KeReleaseMutex
KeInsertQueueDpc
KeSetTimer
IofCompleteRequest
hal
HalTranslateBusAddress
HalGetInterruptVector
IoFlushAdapterBuffers
IoMapTransfer
IoFreeAdapterChannel
HalGetAdapter
HalAllocateCommonBuffer
KfRaiseIrql
READ_PORT_USHORT
WRITE_PORT_USHORT
KeStallExecutionProcessor
KeRaiseIrqlToSynchLevel
KfLowerIrql
KeGetCurrentIrql
HalFreeCommonBuffer
KeQueryPerformanceCounter
HalGetBusData
HalAssignSlotResources
HalSetBusDataByOffset
KfAcquireSpinLock
KfReleaseSpinLock
WRITE_PORT_ULONG
READ_PORT_ULONG
WRITE_PORT_UCHAR
READ_PORT_UCHAR
Sections
.text Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MIX Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ