Static task
static1
General
-
Target
NEAS.53aae9e7a7f902b22182741cf07a34f0.exe
-
Size
350KB
-
MD5
53aae9e7a7f902b22182741cf07a34f0
-
SHA1
b72c31a9a1a2b515e0b3fb2dcb475f375135ab40
-
SHA256
83869dbeda3c4b2fe4952b991670daa562ab1b4eaa1a9db0e6835111c7b4e163
-
SHA512
b3b736f9d19f5061f9d6fdb10fb9b8d97e0ed630fcf7dbb6064b9cc2798290361c32e7d841c02f1939b5638b4ecef5216ba76abd2161b68f4e91bf7bed98a9fe
-
SSDEEP
768:s6z2aYeU9TjDfg+bFVXIxQVvIiqpzvUK/CNmgr/qfaF+R/kE1fIZFV+qdzbRXr3i:TNIHVYCrs/CUr5kE1IZvl3Nr3+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.53aae9e7a7f902b22182741cf07a34f0.exe
Files
-
NEAS.53aae9e7a7f902b22182741cf07a34f0.exe.sys windows:6 windows x86
67c8ee57d210330701d0a505e7594835
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_vsnprintf
DbgPrint
KeServiceDescriptorTable
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
ObfDereferenceObject
KeWaitForSingleObject
ZwReadFile
KeClearEvent
ObReferenceObjectByHandle
ExEventObjectType
IoCreateNotificationEvent
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwCreateFile
memset
RtlAppendUnicodeStringToString
IoVolumeDeviceToDosName
RtlCopyUnicodeString
ObQueryNameString
ZwQueryInformationFile
ZwSetInformationFile
ZwWriteFile
KeReleaseMutex
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
KeSetEvent
memcpy
ExQueueWorkItem
ZwQuerySystemInformation
RtlFreeAnsiString
RtlFreeUnicodeString
wcsrchr
RtlAppendUnicodeToString
ExfInterlockedInsertTailList
KeQueryTimeIncrement
KeTickCount
KeInitializeEvent
wcsstr
_wcsupr
RtlUnicodeStringToAnsiString
IoGetRelatedDeviceObject
IoFileObjectType
_alldiv
_allmul
IoDeleteSymbolicLink
KeDelayExecutionThread
IoCreateSynchronizationEvent
ExfInterlockedRemoveHeadList
KeInitializeMutex
IoRegisterBootDriverReinitialization
InitSafeBootMode
KeBugCheckEx
RtlUnwind
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 321KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ