Static task
static1
General
-
Target
06e1f0f50ed153fc964b8b6f71c28a53
-
Size
40KB
-
MD5
06e1f0f50ed153fc964b8b6f71c28a53
-
SHA1
479e459e8872dd580d6139b94dd9d966a8fc0fb2
-
SHA256
e041113e5c06125b4f99abb969e2eb294c0030988e788aa55e439fec81efb8fe
-
SHA512
789a52d111268e39fb926c15cb041374799177287343ffe12781a1f6e67d5f6a3ae6749b9902620a9537942258057a245272b0cd0cb44fb93f1ba68efef1bf4a
-
SSDEEP
768:pbCrB8ewYQBv98pX0dfpPAuVABGIPmq9C0KHi/R7CHAnfWfg9ToFXf2o6W:pWtpNQBFYCfpPAxmq9C0SiZ7CHAnfWf3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06e1f0f50ed153fc964b8b6f71c28a53
Files
-
06e1f0f50ed153fc964b8b6f71c28a53.sys windows:4 windows x86 arch:x86
03d746cfca819867006ce6cd89e58af2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
ObReferenceObjectByHandle
_wcsnicmp
wcslen
MmIsAddressValid
swprintf
RtlCompareUnicodeString
RtlInitUnicodeString
ObfDereferenceObject
ZwClose
ZwOpenKey
PsCreateSystemThread
ExFreePool
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
_wcsicmp
wcsncpy
wcsrchr
RtlCopyUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwDeleteKey
wcscat
wcscpy
ZwQueryValueKey
_except_handler3
IoGetCurrentProcess
PsGetVersion
_snwprintf
strncmp
KeTickCount
KeQueryTimeIncrement
_stricmp
IoDeviceObjectType
KeQuerySystemTime
wcsstr
_wcslwr
IofCompleteRequest
strncpy
KeDelayExecutionThread
PsLookupProcessByProcessId
_snprintf
wcschr
ZwCreateFile
ZwCreateKey
ZwSetInformationFile
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 94B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ