Static task
static1
General
-
Target
2433e239f29a3642009fc3e12f1b6d8e
-
Size
40KB
-
MD5
2433e239f29a3642009fc3e12f1b6d8e
-
SHA1
59ec48ec06bfe2a259d7522a481c8aba318729c7
-
SHA256
5dcada3b1d3c9ac05aab001e3254ccf11ec932afc9079765a3be02b155f70b26
-
SHA512
625d117d121fa1d34e1567a85609b8ae856aa61af16b6bb8c7614d10de42bd478f5841aba1aa11668b38f569efc825d00c6785c8e8566ee8a173a4da306c86a1
-
SSDEEP
768:RRlB/0FF/kW/R2WTfINg+Xmtij0UXEmq9ztTZBuhSQY3NJfRnCaEZn0TW7vsxOUP:RR3/0vkeQWwg8HfEn9z1ZBkyHfRnCaE2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2433e239f29a3642009fc3e12f1b6d8e
Files
-
2433e239f29a3642009fc3e12f1b6d8e.sys windows:4 windows x86 arch:x86
5bdf24bd4f292eb307a8add1464db83d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
ExFreePool
_snprintf
ExAllocatePoolWithTag
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncmp
IoGetCurrentProcess
ZwSetValueKey
ObReferenceObjectByHandle
wcslen
wcscat
wcscpy
_wcsicmp
_except_handler3
wcsstr
_wcslwr
_wcsnicmp
ZwDeleteKey
MmGetSystemRoutineAddress
strncpy
PsLookupProcessByProcessId
_stricmp
swprintf
ObfDereferenceObject
MmIsAddressValid
wcsncpy
wcsrchr
ZwCreateKey
ZwSetInformationFile
ZwCreateFile
RtlCopyUnicodeString
RtlCompareUnicodeString
PsGetVersion
PsSetCreateProcessNotifyRoutine
IoDeviceObjectType
IoRegisterDriverReinitialization
IofCompleteRequest
_snwprintf
wcschr
KeQuerySystemTime
PsCreateSystemThread
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 67B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ