Static task
static1
General
-
Target
17544159924a8c8d5a0b4bfbdbe16258
-
Size
42KB
-
MD5
17544159924a8c8d5a0b4bfbdbe16258
-
SHA1
fd14daef93e9853dcbe6fbc9648d7c8c74b8768f
-
SHA256
dcb4893db521a259c444c08c2c966192de0be4be5a68f414e77eeccde9d176ba
-
SHA512
735809f383a549106b522b39484919afdd3508e9e8598a472223e2b360bf86ff901ce8400022ebc949766df9f1c1815ee6b301f94eec30823b9496551a533381
-
SSDEEP
768:uFx2sjzTkWdGRrL8p4JX0tjqRwpJ1VPOCs1jUsLBVMo9I/yY:GYT0ArjbLko6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17544159924a8c8d5a0b4bfbdbe16258
Files
-
17544159924a8c8d5a0b4bfbdbe16258.sys windows:5 windows x86 arch:x86
1dd3fa33d8414c580b47ea396c4efab6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlFreeAnsiString
_strnicmp
DbgPrint
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
strstr
_except_handler3
IoGetCurrentProcess
_vsnprintf
RtlUnicodeStringToAnsiString
ZwCreateFile
IoVolumeDeviceToDosName
ObReferenceObjectByHandle
RtlInitAnsiString
strncmp
KeInitializeEvent
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ProbeForWrite
KeInitializeSpinLock
KeServiceDescriptorTable
ZwClose
ZwOpenFile
ZwQueryDirectoryFile
ExFreePoolWithTag
ObfDereferenceObject
ExAllocatePoolWithTag
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
ndis.sys
NdisCancelTimer
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 964B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.STL Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 974B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ