Static task
static1
General
-
Target
1459b27bbff70d1f5fb6979563221907
-
Size
40KB
-
MD5
1459b27bbff70d1f5fb6979563221907
-
SHA1
730919b03ff2e23607cfbef3b3d74bfaa90ce409
-
SHA256
e3a0b179d3864a6409e08788d1ef1ad9682b2039280d220476d33bbbbab4289a
-
SHA512
9f3064ea192be8fbc22cdc9f24ff7c41fe3fb9ee102af325535fd9efe344b35403d25f81f265412af3e80952ee666b58034c55a45977853b69df1aa2b2a83016
-
SSDEEP
768:pEEEA4wOxLo5WYQ9Y9tmh06ah9Bfdz4znNUpygMaFA2yGhI3DC5SDpRBSN2mVD11:phEA2Lo5KY9tmy6ahHfoUSaFkikw6bcv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1459b27bbff70d1f5fb6979563221907
Files
-
1459b27bbff70d1f5fb6979563221907.sys windows:4 windows x86 arch:x86
3484805d605937b43ab417334c514943
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsstr
_wcslwr
_stricmp
swprintf
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
ZwOpenKey
MmIsAddressValid
_snwprintf
ExAllocatePoolWithTag
strncpy
PsLookupProcessByProcessId
ZwSetValueKey
ObReferenceObjectByHandle
ObfDereferenceObject
wcsncpy
wcsrchr
ZwQueryValueKey
_except_handler3
ExFreePool
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
_wcsicmp
KeDelayExecutionThread
KeQuerySystemTime
ZwCreateKey
IoDeviceObjectType
IoRegisterDriverReinitialization
IofCompleteRequest
PsGetVersion
ZwCreateFile
wcschr
PsSetCreateProcessNotifyRoutine
_snprintf
wcscat
wcscpy
KeTickCount
KeQueryTimeIncrement
PsCreateSystemThread
RtlCopyUnicodeString
ZwDeleteKey
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 71B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ