Static task
static1
General
-
Target
69cf83e9ebdc0968bee7d8f12516896840e974a4460064422d920892a55b46fa
-
Size
23KB
-
MD5
945eb28157dc7f7685614523bba4067b
-
SHA1
6d6ced0678d73ee09ddd0a5b6bdb988469629a6c
-
SHA256
69cf83e9ebdc0968bee7d8f12516896840e974a4460064422d920892a55b46fa
-
SHA512
dfda3cf33b6910dc6dacc4306cfbd2a9ec0a38d7c8378e493c916a54dff8f2f87b10de7f49b49b469fc677209251760e69dab1cb6d8c622a8e7c0830f5cbebc5
-
SSDEEP
384:JPDyZPVDiWY3x0F5o4rGQW2YvE/m8cie0mxZ2qzsIG6o78fShF7ZmaL/VKT:DR94yj2uNVie3x3Jy4ShFd/y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 69cf83e9ebdc0968bee7d8f12516896840e974a4460064422d920892a55b46fa
Files
-
69cf83e9ebdc0968bee7d8f12516896840e974a4460064422d920892a55b46fa.sys windows:6 windows x64
bf3d9cae84176f1ff0fdd7173e483aaa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
IoDeleteSymbolicLink
ExFreePoolWithTag
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
RtlInitAnsiString
MmAllocatePagesForMdl
RtlFreeUnicodeString
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
ZwQueryValueKey
RtlRandomEx
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
PsThreadType
IoCreateSymbolicLink
RtlCopyUnicodeString
ObfDereferenceObject
IoCreateDriver
IoCreateDevice
RtlImageNtHeader
ZwQueryInformationThread
ZwOpenKey
RtlImageDirectoryEntryToData
PsGetProcessPeb
RtlDowncaseUnicodeString
RtlAppendUnicodeToString
ZwQuerySystemInformation
KeDelayExecutionThread
ZwCreateFile
RtlCompareUnicodeString
ZwQueryInformationProcess
PsGetProcessWow64Process
MmIsAddressValid
_stricmp
ProbeForRead
KeSetImportanceDpc
KeSetTargetProcessorDpc
PsSetLoadImageNotifyRoutine
KeInitializeDpc
IoFreeMdl
IoGetCurrentProcess
KeInsertQueueDpc
PsRemoveLoadImageNotifyRoutine
PsInitialSystemProcess
MmProbeAndLockPages
MmUnlockPages
KeNumberProcessors
IoAllocateMdl
KeBugCheckEx
__C_specific_handler
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 440B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ