Static task
static1
General
-
Target
6717c4865c0e59c8e181dae2e0ee9187b4e2f8c4740f8e20704cae9127f24f8a
-
Size
21KB
-
MD5
addf1bd4a498a78a46dee1e92fe2ecff
-
SHA1
143a2c920e85597d61c6d25c77a1d55070b9cad1
-
SHA256
6717c4865c0e59c8e181dae2e0ee9187b4e2f8c4740f8e20704cae9127f24f8a
-
SHA512
a6f476441887cdcdad3975eea70807caaae3ad75c7db2ff19d30f19d7d3a6d8a9fae1ddd9f1d094a69a4ba87ca47d898517d643d85dcbea8e0f09ecaecac9b13
-
SSDEEP
384:jveF+WreNz/65UrgosltSiMn5GIx181p35V/rVnTqoxDnn+V1:zSd8S4gTtSjn5GSu1Z5V/rV2ohS1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6717c4865c0e59c8e181dae2e0ee9187b4e2f8c4740f8e20704cae9127f24f8a
Files
-
6717c4865c0e59c8e181dae2e0ee9187b4e2f8c4740f8e20704cae9127f24f8a.sys windows:10 windows x64
2cfcc7b7961a51de3744ac4ada316159
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlCompareUnicodeString
RtlGetVersion
KeDelayExecutionThread
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocateContiguousMemory
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetCurrentProcess
ObReferenceObjectByHandle
ObReferenceObjectByHandleWithTag
ObCloseHandle
ObfDereferenceObject
MmGetPhysicalAddress
MmGetVirtualForPhysical
MmIsAddressValid
IoCreateFileEx
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
PsLookupThreadByThreadId
MmFlushImageSection
ZwDeleteFile
ZwAllocateVirtualMemory
ZwGetNextThread
MmCopyVirtualMemory
PsGetProcessPeb
MmMarkPhysicalMemoryAsBad
KeInitializeApc
KeInsertQueueApc
__C_specific_handler
IoFileObjectType
PsThreadType
MmUserProbeAddress
PsWrapApcWow64Thread
PsGetCurrentThreadId
PsGetProcessId
PsIsThreadTerminating
ZwFreeVirtualMemory
ZwQueryVirtualMemory
ZwQuerySystemInformation
PsGetProcessWow64Process
KeTestAlertThread
PsGetCurrentProcessWow64Process
PsGetThreadTeb
RtlInitAnsiString
RtlCompareString
RtlImageNtHeader
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlRandomEx
RtlImageDirectoryEntryToData
strcmp
MmMapIoSpace
MmUnmapIoSpace
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ