Static task
static1
General
-
Target
2e3af046c31cfe3bbe1ffc56beb59989
-
Size
3KB
-
MD5
2e3af046c31cfe3bbe1ffc56beb59989
-
SHA1
a2fa6e3df5ad317e2d128cbf14b69a76c57a21cd
-
SHA256
8f78fa894b5d63fcb4c44cc19671e772fb9771eb60699d31e699b0a8f52d8d5c
-
SHA512
c30cd8742cb8aa467b3ac32b677ad570d9d58598f30bccfe271f113a4ec6db04ad99e6ad63ac8ed64a17134c48b994a6828d686465d72fa4c2f4110e09a6239f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e3af046c31cfe3bbe1ffc56beb59989
Files
-
2e3af046c31cfe3bbe1ffc56beb59989.sys windows:5 windows x86 arch:x86
17cc3e1a77580649e7e4deeb68a6c01d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoDeleteDevice
DbgPrint
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoGetCurrentProcess
strncmp
IoDeleteSymbolicLink
IofCompleteRequest
_snprintf
PsGetCurrentProcessId
ExAllocatePoolWithTag
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 226B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 352B - Virtual size: 340B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 160B - Virtual size: 138B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ