Static task
static1
General
-
Target
02610b11137ac9e7aa3edbd2c68f3cbd
-
Size
32KB
-
MD5
02610b11137ac9e7aa3edbd2c68f3cbd
-
SHA1
943b419b63b286d47d49c97d680f291f15098a9f
-
SHA256
47cd03e146872b293d8552d4a728ead9a6cefe92698ff309ebec28ee717ac54f
-
SHA512
04de18010aaba362cb68feee1a4f0740e67e8acd289a01dbdfba706b3579794491fb23c3936d0fc0259e2adab65ad12617b38ad49d25cfac75060a80f235d1f4
-
SSDEEP
384:DzE/ZoTc/mnveT0dFj1HUmEvJhxPNa5eMn7ehLeQG8t86ACWXDfWq0MWs1ZTeHe+:bDeTax10F967niXpWXGwFbudkMmeP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 02610b11137ac9e7aa3edbd2c68f3cbd
Files
-
02610b11137ac9e7aa3edbd2c68f3cbd.sys windows:6 windows x86 arch:x86
3c1d8840e039fd44420771b586ccbff2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoWMIWriteEvent
ExAllocatePoolWithTag
memcpy
MmGetSystemRoutineAddress
RtlInitUnicodeString
RtlCompareMemory
IoWMIRegistrationControl
KeWaitForSingleObject
ExFreePoolWithTag
KeSetEvent
KeResetEvent
KeInitializeEvent
IoReportRootDevice
KeTickCount
KeBugCheckEx
RtlAnsiCharToUnicodeChar
RtlCopyUnicodeString
EtwWrite
EtwUnregister
EtwRegister
ZwLoadDriver
memset
wdfldr.sys
WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 697B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ