Static task
static1
General
-
Target
1d2c5c0725f37c2417c089c8f0c6dd6a
-
Size
40KB
-
MD5
1d2c5c0725f37c2417c089c8f0c6dd6a
-
SHA1
5c9758679abfeaaa340415bc25655f96509ed168
-
SHA256
5b985693f54e18c9437dd218533b2b9f1900d5c103580e36f4fe7e552df11901
-
SHA512
5e0b3f24567622feff9b20f04d8b175dc1282b094e2cc154da278cc1ea5bb47f271d63355f3f51abf15c5f7a74006e59befa9942bac930de4728ef91d07de74e
-
SSDEEP
768:aILei2kqdPOTr1FuUufgRuY0gvWzQybsGfHDZ/RZ+SyG6z5fr8H0TBibTAbcFgXk:aIKiChOf1EhgwY0A6ft/n+SyG6z+H0Tw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d2c5c0725f37c2417c089c8f0c6dd6a
Files
-
1d2c5c0725f37c2417c089c8f0c6dd6a.sys windows:4 windows x86 arch:x86
2ce8f3c293ecad6cab18957c0e37a9a1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
ZwCreateKey
RtlInitUnicodeString
swprintf
wcsncpy
wcsrchr
ZwQueryValueKey
KeDelayExecutionThread
KeQuerySystemTime
_wcsnicmp
IofCompleteRequest
_wcsicmp
ZwClose
ZwDeleteKey
ZwOpenKey
PsCreateSystemThread
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
MmGetSystemRoutineAddress
ZwSetValueKey
ObReferenceObjectByHandle
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncpy
IoGetCurrentProcess
PsSetCreateProcessNotifyRoutine
RtlCompareUnicodeString
_stricmp
wcsstr
_wcslwr
wcscat
wcscpy
strncmp
PsGetVersion
KeTickCount
KeQueryTimeIncrement
MmIsAddressValid
PsLookupProcessByProcessId
_snprintf
IoRegisterDriverReinitialization
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
ZwSetInformationFile
ZwCreateFile
IoDeviceObjectType
_snwprintf
wcschr
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ