Static task
static1
General
-
Target
2ab6795deef1577e56df88b7849480cb7a3587dee0379ea030148302dcefd428
-
Size
596KB
-
MD5
3f5b9d147ab031fbf763f9a7e522b478
-
SHA1
20dfa9b44494b8d77e710fa67759d47c25452d80
-
SHA256
2ab6795deef1577e56df88b7849480cb7a3587dee0379ea030148302dcefd428
-
SHA512
69e129d841d504823d2319d23844e9201cb596e1ba6cf5e2a598b37264ee079780dd388c8459fe6eb6cbfedf01b913bb92a36fc38aa687ef3819a2f888f35fd0
-
SSDEEP
6144:7HEKYQGVHe7h18NyaQ4aESQv+drF23KqLD6iuDn0vtfmCQaWCpY+H6bNwnw7Mhjk:r5gU3ES++5F8LNuDUdtdpNwN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ab6795deef1577e56df88b7849480cb7a3587dee0379ea030148302dcefd428
Files
-
2ab6795deef1577e56df88b7849480cb7a3587dee0379ea030148302dcefd428.sys windows:10 windows x64 arch:x64
b0f4331c853fe7dcc074d4b544cc1d7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
fltmgr.sys
FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltRegisterFilter
FltEnumerateFilters
FltGetFilterInformation
FltReleaseFileNameInformation
FltGetFileNameInformationUnsafe
FltParseFileName
ntoskrnl.exe
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsCreateSystemThread
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
EtwRegister
EtwUnregister
EtwWriteTransfer
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwOpenKey
RtlGetVersion
RtlUpcaseUnicodeString
MmGetPhysicalAddress
MmIsAddressValid
PsSetLoadImageNotifyRoutine
ZwOpenProcess
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ObOpenObjectByPointer
ZwDuplicateObject
ZwQueryInformationProcess
ZwOpenThread
ObReferenceObjectByName
__C_specific_handler
PsProcessType
IoDriverObjectType
InitSafeBootMode
KeBugCheckEx
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlInitUnicodeString
_wcsicmp
wcsrchr
KeSetPriorityThread
RtlEnumerateGenericTableAvl
KeInitializeEvent
ExAcquireFastMutex
ExReleaseFastMutex
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePool
MmUnlockPages
IoFreeMdl
KeStackAttachProcess
KeUnstackDetachProcess
ZwQuerySystemInformation
ObReferenceObjectByHandleWithTag
ObfDereferenceObjectWithTag
ZwOpenFile
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
RtlRunOnceInitialize
RtlRunOnceBeginInitialize
RtlRunOnceComplete
PsGetCurrentProcessId
ObMakeTemporaryObject
ZwQuerySecurityObject
RtlImageNtHeader
ZwQuerySection
RtlImageDirectoryEntryToData
PsInitialSystemProcess
wcscpy_s
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExAcquireRundownProtection
ExAcquireRundownProtectionEx
ExReleaseRundownProtection
ExReleaseRundownProtectionEx
CmUnRegisterCallback
PsTerminateSystemThread
IoIs32bitProcess
ObUnRegisterCallbacks
PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
vsprintf_s
PsThreadType
ExDesktopObjectType
vDbgPrintExWithPrefix
PsGetThreadId
PsGetThreadProcessId
KeNumberProcessors
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExInitializeResourceLite
ExDeleteResourceLite
wcsstr
wcsnlen
RtlEqualUnicodeString
ProbeForRead
PsGetCurrentThreadTeb
wcsncat_s
KeSetEvent
KeWaitForSingleObject
ExRaiseStatus
IoAllocateIrp
IofCallDriver
IoCreateFile
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
IoGetFileObjectGenericMapping
ZwDeleteFile
ObCreateObject
SeCreateAccessState
IoFileObjectType
MmMapIoSpace
MmUnmapIoSpace
ZwQueryVirtualMemory
KeClearEvent
ExAllocatePoolWithQuotaTag
ExGetPreviousMode
ObCloseHandle
PsGetProcessId
SeLocateProcessImageName
PsGetThreadProcess
ObInsertObject
PsReferenceProcessFilePointer
ZwFlushInstructionCache
MmUserProbeAddress
ZwCreateKey
ZwDeleteKey
ZwSetValueKey
Sections
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 474KB - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ