Static task
static1
Behavioral task
behavioral1
Sample
00c100218ca833c198bb1b905fd3a1ed.sys
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
00c100218ca833c198bb1b905fd3a1ed.sys
Resource
win10v2004-20231215-en
General
-
Target
00c100218ca833c198bb1b905fd3a1ed
-
Size
141KB
-
MD5
00c100218ca833c198bb1b905fd3a1ed
-
SHA1
8736efbd20a18bf66d46cbd5289072a93307b00b
-
SHA256
a992175a42e509c3fdd55e49bcccad53c53d48a2a396f757ac8a2ebf14f384e3
-
SHA512
3222263682d7760b0a6f8b7e64330f4cf0ffe7527e23f321600a97676fbee3515e05853a8e9ef02894e6c5624cac711ff3d71101546f5936a144d32612acdc15
-
SSDEEP
3072:KDdHowjU3pK9gYOBelmKXyPCJi1DrizUwpWteJc8xuTz9P+ZA8RA:gIwjU3pK9gY6elJCsEDrMDpsPqS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00c100218ca833c198bb1b905fd3a1ed
Files
-
00c100218ca833c198bb1b905fd3a1ed.sys .js windows:5 windows x86 arch:x86 polyglot
24c831a88914d90e8bb4b09c10bb2403
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_vsnprintf
_vsnwprintf
ZwClose
ZwWriteFile
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
KeQuerySystemTime
_alldiv
KeDelayExecutionThread
rand
srand
ZwSetInformationFile
NtLockFile
ZwOpenFile
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
IofCompleteRequest
memmove
ZwEnumerateKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwCreateKey
RtlAppendUnicodeToString
RtlCompareMemory
KeWaitForSingleObject
ZwQueryDirectoryFile
_strnicmp
MmMapLockedPages
ObReferenceObjectByHandle
ObReferenceObjectByName
IoDriverObjectType
PsCreateSystemThread
KeTickCount
KeBugCheckEx
sprintf
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ