Static task
static1
General
-
Target
ad90380de73fbb3eb3de6ddbf944c9e19f5059d4ddad30f38a1eca62ccb131fc
-
Size
596KB
-
MD5
d1508c8aeacf6b6f80fef0e872096baf
-
SHA1
e7cf5535f03b25e9a30d7b759c4f5502b5bf4af1
-
SHA256
ad90380de73fbb3eb3de6ddbf944c9e19f5059d4ddad30f38a1eca62ccb131fc
-
SHA512
4f6b7cd9905727d46b2ec58960b9e94938b3a3d2eac02ebd6f6b21e7ec60ab0c50e1168f022f472caba3710e85a82d9cd9cb184052fbbacb7f8c23d1c0825f18
-
SSDEEP
6144:3HEKYQGVHe7h18NyaQ4aESQv+drF23KqLD6iuDn0vtfmCQaWCpY+H6bNwnw7MhjV:H5gU3ES++5F8LNuDUdtdpNwQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad90380de73fbb3eb3de6ddbf944c9e19f5059d4ddad30f38a1eca62ccb131fc
Files
-
ad90380de73fbb3eb3de6ddbf944c9e19f5059d4ddad30f38a1eca62ccb131fc.sys windows:10 windows x64 arch:x64
b0f4331c853fe7dcc074d4b544cc1d7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
fltmgr.sys
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltRegisterFilter
FltEnumerateFilters
FltGetFilterInformation
FltReleaseFileNameInformation
FltGetFileNameInformationUnsafe
FltParseFileName
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsCreateSystemThread
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
EtwRegister
EtwUnregister
EtwWriteTransfer
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwOpenKey
RtlGetVersion
RtlUpcaseUnicodeString
MmGetPhysicalAddress
MmIsAddressValid
PsSetLoadImageNotifyRoutine
ZwOpenProcess
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ObOpenObjectByPointer
ZwDuplicateObject
ZwQueryInformationProcess
ZwOpenThread
ObReferenceObjectByName
__C_specific_handler
PsProcessType
IoDriverObjectType
InitSafeBootMode
KeBugCheckEx
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlInitUnicodeString
_wcsicmp
wcsrchr
KeSetPriorityThread
RtlEnumerateGenericTableAvl
KeInitializeEvent
ExAcquireFastMutex
ExReleaseFastMutex
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePool
MmUnlockPages
IoFreeMdl
KeStackAttachProcess
KeUnstackDetachProcess
ZwQuerySystemInformation
ObReferenceObjectByHandleWithTag
ObfDereferenceObjectWithTag
ZwOpenFile
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
RtlRunOnceInitialize
RtlRunOnceBeginInitialize
RtlRunOnceComplete
PsGetCurrentProcessId
ObMakeTemporaryObject
ZwQuerySecurityObject
RtlImageNtHeader
ZwQuerySection
RtlImageDirectoryEntryToData
PsInitialSystemProcess
wcscpy_s
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExAcquireRundownProtection
ExAcquireRundownProtectionEx
ExReleaseRundownProtection
ExReleaseRundownProtectionEx
CmUnRegisterCallback
PsTerminateSystemThread
IoIs32bitProcess
ObUnRegisterCallbacks
PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
vsprintf_s
PsThreadType
ExDesktopObjectType
vDbgPrintExWithPrefix
PsGetThreadId
PsGetThreadProcessId
KeNumberProcessors
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExInitializeResourceLite
ExDeleteResourceLite
wcsstr
wcsnlen
RtlEqualUnicodeString
ProbeForRead
PsGetCurrentThreadTeb
wcsncat_s
KeSetEvent
KeWaitForSingleObject
ExRaiseStatus
IoAllocateIrp
IofCallDriver
IoCreateFile
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
IoGetFileObjectGenericMapping
ZwDeleteFile
ObCreateObject
SeCreateAccessState
IoFileObjectType
MmMapIoSpace
MmUnmapIoSpace
ZwQueryVirtualMemory
KeClearEvent
ExAllocatePoolWithQuotaTag
ExGetPreviousMode
ObCloseHandle
PsGetProcessId
SeLocateProcessImageName
PsGetThreadProcess
ObInsertObject
PsReferenceProcessFilePointer
ZwFlushInstructionCache
MmUserProbeAddress
ZwCreateKey
ZwDeleteKey
ZwSetValueKey
Sections
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 474KB - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ