Static task
static1
General
-
Target
148eca1c0571fe24296f2f4724af3bf7
-
Size
40KB
-
MD5
148eca1c0571fe24296f2f4724af3bf7
-
SHA1
73975fde82cfe916092ac7d8cd08fb6bdaf20f66
-
SHA256
e12cb35923f7bd93c89a4afd18801659bc845f48b19a6ef474eddb48b6fe45c1
-
SHA512
039db7d93a61b9c531eb17cc66b8c5cfed97c148d619ed851a27cc73f14312b899b86264a503d7f30be844ba16aeb30a7818f2d70ac9080ba6a80f9ca798cfcb
-
SSDEEP
768:e6DfpcOWMXYpQTTqkDkiAAwY38/7uF7fWE7+02FoJ0tHPdRdCtGoq:hfpcOvopQTrDkdliF7h+0pJKPd/CtGp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 148eca1c0571fe24296f2f4724af3bf7
Files
-
148eca1c0571fe24296f2f4724af3bf7.sys windows:4 windows x86 arch:x86
07db5c2d54ef798c04f0f3527777e1f1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCopyUnicodeString
_wcsnicmp
wcslen
RtlInitUnicodeString
ObfDereferenceObject
ZwClose
_snwprintf
wcsncpy
wcschr
ZwSetInformationFile
ZwCreateFile
wcscpy
swprintf
RtlAnsiStringToUnicodeString
ZwDeleteKey
ObReferenceObjectByHandle
wcsstr
_wcslwr
ExFreePool
ExAllocatePoolWithTag
KeDelayExecutionThread
KeQuerySystemTime
_stricmp
ZwSetValueKey
wcscat
ZwQueryValueKey
ZwOpenKey
_except_handler3
PsCreateSystemThread
MmGetSystemRoutineAddress
ZwCreateKey
wcsrchr
RtlCompareUnicodeString
strncmp
IoGetCurrentProcess
PsGetVersion
MmIsAddressValid
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncpy
_snprintf
IoRegisterDriverReinitialization
_wcsicmp
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 73B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ