Static task
static1
General
-
Target
3a0df6fbfb742ef72893d0b6068e67f9
-
Size
75KB
-
MD5
3a0df6fbfb742ef72893d0b6068e67f9
-
SHA1
bd976826b07f09d35a634fbed1b4823c5a1f965b
-
SHA256
75963dedcb3bb2f24471a375afc828af0fa80436fe18b6788561f5642d6eac38
-
SHA512
5ba0a813c16eac36a07ab690721f6218546adc61c1a4ec73f8f1f7d991afd937bc4e2b7a679f0b61e36216bf89c0ad33dd8cf9ac6cccbcf3dad984f52ab24f7e
-
SSDEEP
1536:h0udcsivoIbrPhlU3KgzDxqGoS4vP1sjDf7Dfv7YMPvJZEKR7R6yZuwnx:/cvXnPhG3hvxqi4Gv7Dfv7lPvJZE8Rj5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a0df6fbfb742ef72893d0b6068e67f9
Files
-
3a0df6fbfb742ef72893d0b6068e67f9.sys windows:4 windows x86 arch:x86
9c1df7ee54a72c34311ce59f1c2771aa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
_purecall
ExAllocatePoolWithTag
ExFreePool
memcpy
KeQuerySystemTime
memset
_vsnprintf
PsTerminateSystemThread
KeWaitForSingleObject
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
ZwCreateFile
IoDeleteSymbolicLink
KeInitializeSpinLock
KeSetEvent
KeClearEvent
KeInitializeEvent
InterlockedIncrement
InterlockedDecrement
IofCallDriver
IoBuildDeviceIoControlRequest
RtlCompareMemory
IoGetRelatedDeviceObject
RtlUnwind
IoDeleteDevice
DbgPrint
memmove
hal
KfAcquireSpinLock
KfReleaseSpinLock
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ