Static task
static1
General
-
Target
9c627b0f66866c8deaa6d78c120e4c1eb441cb09236ae8087c0c97a44831c2ca
-
Size
362KB
-
MD5
defd55f323370a505cf1f6a81c4876fd
-
SHA1
13faab5d7c5f89d1daa2ed86c49eaef9213ba60c
-
SHA256
9c627b0f66866c8deaa6d78c120e4c1eb441cb09236ae8087c0c97a44831c2ca
-
SHA512
a6fd9990da815bda81f661dfcef822eabc3803713fabf1041dbae529ac991b1252fe0fcfc0023d8ec04a28fa7f25acdd83afa3c107671eb8da781e82334664da
-
SSDEEP
6144:DhsLac8tBR/wgL+mghnNCCd/S48dXEG9QnI50F6K1w+Dgiv2gAknu5zfB8VOR6gd:DeLaJX/wgLTgLCY//80zAkI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c627b0f66866c8deaa6d78c120e4c1eb441cb09236ae8087c0c97a44831c2ca
Files
-
9c627b0f66866c8deaa6d78c120e4c1eb441cb09236ae8087c0c97a44831c2ca.sys windows:6 windows x86
7b37658e2b0bb3c26e3ec82b1ec8c61e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObQueryNameString
RtlImageNtHeader
RtlMultiByteToUnicodeN
IoGetDeviceObjectPointer
KeInitializeEvent
ProbeForRead
ProbeForWrite
PsSetCreateProcessNotifyRoutine
ExInitializeResourceLite
ExAcquireResourceSharedLite
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
KeLeaveCriticalRegion
ExReleaseResourceLite
ExDeleteResourceLite
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlDeleteElementGenericTable
RtlEnumerateGenericTable
RtlInitializeGenericTable
CmRegisterCallback
MmHighestUserAddress
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
PsLookupThreadByThreadId
PsGetCurrentThreadId
KeDelayExecutionThread
PsCreateSystemThread
MmSystemRangeStart
PsSetLoadImageNotifyRoutine
RtlUpcaseUnicodeString
ZwDeleteValueKey
ZwCreateKey
ZwSetValueKey
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
wcschr
ZwQueryValueKey
RtlDecompressBuffer
IoGetDeviceAttachmentBaseRef
ZwReadFile
RtlAppendUnicodeStringToString
InterlockedPopEntrySList
InterlockedPushEntrySList
ExDeletePagedLookasideList
ExInitializePagedLookasideList
RtlAppendUnicodeToString
CmUnRegisterCallback
ZwWriteFile
ZwSetInformationFile
ZwDeleteFile
ZwQueryInformationFile
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
MmUnmapLockedPages
ZwOpenFile
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlCreateUnicodeString
_wcsicmp
wcsncpy
wcsncmp
RtlGetVersion
RtlIntegerToUnicodeString
RtlUnicodeStringToInteger
ZwEnumerateKey
ZwQueryKey
_allmul
KeTickCount
wcsrchr
ExInitializeRundownProtection
PsIsSystemThread
IoGetTopLevelIrp
RtlPrefixUnicodeString
MmIsAddressValid
ZwOpenSymbolicLinkObject
KeSetEvent
ZwSetInformationThread
ExAcquireRundownProtection
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
KeResetEvent
KeWaitForSingleObject
KeInitializeSemaphore
KeWaitForMultipleObjects
KeReleaseSemaphore
_alldiv
memmove
ZwQueryInformationProcess
ObOpenObjectByPointer
ExSystemTimeToLocalTime
PsGetVersion
KeQuerySystemTime
RtlInitAnsiString
_wcsnicmp
ObOpenObjectByName
MmUserProbeAddress
IoFileObjectType
ZwTerminateProcess
ZwOpenProcess
FsRtlDissectName
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlGetElementGenericTableAvl
ExRaiseDatatypeMisalignment
KeQueryTimeIncrement
ExSemaphoreObjectType
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeBugCheckEx
ObfReferenceObject
ZwOpenKey
RtlCompareMemory
KeGetCurrentThread
RtlCopyUnicodeString
RtlCompareUnicodeString
PsTerminateSystemThread
IoGetCurrentProcess
PsInitialSystemProcess
PsProcessType
PsGetProcessId
PsLookupProcessByProcessId
ExGetPreviousMode
PsThreadType
ObReferenceObjectByHandle
ObfDereferenceObject
memcpy
IoThreadToProcess
PsGetProcessInheritedFromUniqueProcessId
RtlHashUnicodeString
PsGetThreadProcessId
RtlEqualUnicodeString
InitSafeBootMode
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoRegisterShutdownNotification
MmGetSystemRoutineAddress
RtlInitUnicodeString
PsGetCurrentProcessId
IofCompleteRequest
ZwCreateFile
ZwDeviceIoControlFile
ZwClose
_vsnwprintf
memset
RtlUnwind
ZwDeleteKey
PsIsThreadTerminating
KeInsertQueueApc
KeInitializeApc
FsRtlIsNameInExpression
RtlFreeAnsiString
FsRtlIsDbcsInExpression
RtlUnicodeStringToAnsiString
ZwQuerySystemInformation
PsGetProcessCreateTimeQuadPart
KeUnstackDetachProcess
KeStackAttachProcess
PsGetProcessPeb
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwEnumerateValueKey
IoAllocateIrp
IoGetBaseFileSystemDeviceObject
IoFreeIrp
IoCreateFile
ZwSetInformationObject
ZwQueryObject
ZwDuplicateObject
RtlQueryRegistryValues
KeAreApcsDisabled
ExRaiseStatus
IoVolumeDeviceToDosName
IoGetRelatedDeviceObject
IoCreateFileSpecifyDeviceObjectHint
ZwQueryDirectoryFile
_allshl
_aullshr
ExAllocatePoolWithTag
ZwQuerySymbolicLinkObject
ExFreePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
fltmgr.sys
FltDeletePushLock
FltRegisterFilter
FltGetFileNameInformationUnsafe
FltCreateFile
FltClose
FltSendMessage
FltQueryInformationFile
FltGetDestinationFileNameInformation
FltParseFileNameInformation
FltSetStreamContext
FltAllocateContext
FltGetVolumeContext
FltGetStreamContext
FltGetRequestorProcessId
FltGetRequestorProcess
FltReadFile
FltGetVolumeProperties
FltSetVolumeContext
FltReleaseContext
FltGetVolumeName
FltAcquirePushLockExclusive
FltAcquirePushLockShared
FltReleasePushLock
FltInitializePushLock
FltGetFileNameInformation
FltReleaseFileNameInformation
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltFreeSecurityDescriptor
FltCloseClientPort
FltStartFiltering
Sections
.text Size: 283KB - Virtual size: 283KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ