Static task
static1
General
-
Target
NEAS.70e8376fba5bb542e709de0afdf4a570.exe
-
Size
20KB
-
MD5
70e8376fba5bb542e709de0afdf4a570
-
SHA1
400afc3fca02a637a1c942e873f502348158ed43
-
SHA256
0510324ed02b079f48c5e61e1f0a449b6a67f1a1dd6c18829e481b620b84e1b7
-
SHA512
0f8c50c394d1c1007b5432eebc6d084e60f914ee80a52d4faaaa73f64c5cdec532874d7c358cf926e31136297f3ba6fe3864c5b8231b6df8e375b05874d35a79
-
SSDEEP
384:C+PnjZANFG7voejjjjjJJ/rSK29+YbS0X0a:C+PnjZGFG7VjjjjjJJjSK29nbS0X0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.70e8376fba5bb542e709de0afdf4a570.exe
Files
-
NEAS.70e8376fba5bb542e709de0afdf4a570.exe.sys windows:5 windows x86
b671421ad5960b5b75930a13403e0326
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ProbeForWrite
ProbeForRead
ZwQueryInformationProcess
ZwPulseEvent
_except_handler3
_stricmp
IofCompleteRequest
ObReferenceObjectByHandle
RtlFreeUnicodeString
IoCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoFreeIrp
RtlInitUnicodeString
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
IoFileObjectType
strncmp
IoGetCurrentProcess
IoDeleteDevice
IoDeleteSymbolicLink
ZwQuerySystemInformation
IoCreateDevice
KeSetEvent
IoCreateSymbolicLink
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 864B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sosata2 Size: 32B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sosata1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ESTisb Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 896B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 832B - Virtual size: 830B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ