Static task
static1
General
-
Target
10de1f9646bfd25a8b2832690360750b
-
Size
40KB
-
MD5
10de1f9646bfd25a8b2832690360750b
-
SHA1
798ab73a811cfff2c44e9bcfe57e155d7a14083f
-
SHA256
e289b98d572e6172766645b132d5dee3745368024fc262f1df114e8d20f5647b
-
SHA512
8e886d8f658c365de60e880f722a3aa54df9cbef7d0d68d751b08dbfb8bd594fdfdd173d2697292e786e8bd61b1cfd7ec42e93e28f2b02b530351e6435525db6
-
SSDEEP
768:NVsZOWhmuzDfqdkn0TH8GxMTkH4/t2X+qO310vA5yBXV2SmC:N2OAmOLqdjTcGxmkYY+t3evAoz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10de1f9646bfd25a8b2832690360750b
Files
-
10de1f9646bfd25a8b2832690360750b.sys windows:4 windows x86 arch:x86
91aa80c2d25b2d51ccc62dc0f02d587c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
_wcsnicmp
KeQuerySystemTime
MmIsAddressValid
ExFreePool
_snprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
strncmp
IoGetCurrentProcess
strncpy
_wcsicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwSetValueKey
IoDeviceObjectType
wcsncpy
PsGetVersion
ZwQueryValueKey
RtlCopyUnicodeString
ObfDereferenceObject
ObReferenceObjectByHandle
ZwOpenKey
wcsrchr
wcsstr
_wcslwr
PsLookupProcessByProcessId
_stricmp
ZwCreateKey
ZwDeleteKey
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization
_snwprintf
_except_handler3
wcscat
RtlAnsiStringToUnicodeString
IofCompleteRequest
wcschr
PsCreateSystemThread
RtlCompareUnicodeString
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ