Static task
static1
General
-
Target
NEAS.951be9c901adbb6ea4ebd5b7cb00d1f0.exe
-
Size
8KB
-
MD5
951be9c901adbb6ea4ebd5b7cb00d1f0
-
SHA1
7f9eccd1a97863e0047edbfd72bce4f8959e7bef
-
SHA256
08c8b85cf685b6cbd98cf289fcd26b4922b8535260d246b19a581d6799c3aa3a
-
SHA512
cf1a777e5d3e1fd9e54b5232919acbc7f386dadf9244731a83fe4eefa1b49ca89877c3653cd66feffb49fa681669d65b9ad928a77d1495574527c4448ad66db3
-
SSDEEP
96:iTCQslmR/YIVxyyAyV/tS9mpGlXLQwKzUrzhCOR+kavxazvq/FJwoa:iGUR/YIxjpGlXLbE8v4FC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.951be9c901adbb6ea4ebd5b7cb00d1f0.exe
Files
-
NEAS.951be9c901adbb6ea4ebd5b7cb00d1f0.exe.sys windows:5 windows x86
ca0590dfbb65bd5e4662e5f58af98b3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoCreateDevice
RtlInitUnicodeString
KeServiceDescriptorTable
MmGetSystemRoutineAddress
strncmp
strlen
DbgPrint
strncpy
strcmp
IoDeleteSymbolicLink
IofCompleteRequest
ExAllocatePoolWithTag
IoCreateSymbolicLink
IoGetCurrentProcess
IoDeleteDevice
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 446B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ