Static task
static1
General
-
Target
15a942e2a7a646cc9ddf64826cda2b73
-
Size
11KB
-
MD5
15a942e2a7a646cc9ddf64826cda2b73
-
SHA1
4f11939f6b30d21ee534eeba6a24e2fe2b0d75e5
-
SHA256
944225006ea8aaeb1f75ffde0ec7cb70f7ad71f99e1b14afa12eb2c902e1e9c9
-
SHA512
121a680babe71deed1efe47d322cbad723722d22f30d44129c821e28e3e1b806a3c5b1539ddffde0fcd239a9bd7ca64195dcf53315447ac8e665beedcf78bb20
-
SSDEEP
192:NVF2NDDfX8+mAfgDxM20i4yLxcgY/ZDmssnWcNWro:RUDfM+m5DyVucdDmsiWcNW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15a942e2a7a646cc9ddf64826cda2b73
Files
-
15a942e2a7a646cc9ddf64826cda2b73.sys windows:5 windows x86 arch:x86
18e74cd9b722c97e921d5a9c36578080
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwCreateFile
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwCreateKey
KeServiceDescriptorTable
RtlInitUnicodeString
RtlCompareMemory
IofCompleteRequest
IoRegisterDriverReinitialization
RtlFreeAnsiString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
swprintf
mbstowcs
IoCreateSymbolicLink
IoCreateDevice
wcscat
_strlwr
RtlUnicodeStringToAnsiString
wcsrchr
_wcslwr
ZwEnumerateKey
ZwOpenKey
ExFreePool
ExAllocatePoolWithTag
ZwOpenFile
strncmp
IoGetCurrentProcess
PsTerminateSystemThread
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
sprintf
_stricmp
strncpy
PsLookupProcessByProcessId
KeDelayExecutionThread
wcslen
_snprintf
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
MmIsAddressValid
ZwUnmapViewOfSection
_except_handler3
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 309B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 618B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ