Static task
static1
General
-
Target
3d80019dd88a184a93bd39bb5587caf7
-
Size
26KB
-
MD5
3d80019dd88a184a93bd39bb5587caf7
-
SHA1
ad91d8f3d2a67bd6332224431ae0332755a906b7
-
SHA256
817a3e5fe85d870b2446d05896f875e1be361eb35ce60dc667ec59606e19116a
-
SHA512
68048ab94aa30af99ff1a4019464079c1b8cfd2549f72b6ca014673254629e041f14f3645e1b4e299f1e0a101cc816a70374cf9d7af7d93d2c07cce22ec6a09c
-
SSDEEP
768:7Ad1HIx7eP6sajz8hHYBNjJ+ANiOWOb700KoH1ZN:7AdJIFePQghHIlsAsOB/0bgZN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d80019dd88a184a93bd39bb5587caf7
Files
-
3d80019dd88a184a93bd39bb5587caf7.sys windows:4 windows x86 arch:x86
c824a0f9cec477e10de75b9315b744d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_strnicmp
RtlInitUnicodeString
_wcsnicmp
wcslen
wcscat
wcscpy
_except_handler3
swprintf
RtlAnsiStringToUnicodeString
ObfDereferenceObject
MmGetSystemRoutineAddress
_stricmp
strncpy
MmIsAddressValid
RtlCopyUnicodeString
ZwClose
ZwOpenKey
strncmp
IofCompleteRequest
ExFreePool
_snprintf
ExAllocatePoolWithTag
_itow
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 890B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ