Static task
static1
General
-
Target
313676c3a932a46489420d08119e1ad1
-
Size
40KB
-
MD5
313676c3a932a46489420d08119e1ad1
-
SHA1
ddf4513f0000d650330953751332f2737f791737
-
SHA256
dce84082ab18252a3103adb0f21daa146b7fb91758f1082828dceb6613cf3770
-
SHA512
4a2aa0846617d5d351db71e1adf939ff9e9151eed317c92eace1885704c4376a2aebd5c0aa6aaba392529d3e78fa01a7adeb24284226068ac0d928559b8e22d2
-
SSDEEP
768:7Yx05AioafhYmB5SJ6hXu5UavJvpU4jk1mZyBGKD4yt6VtSx3:N5A+akwJ6UxvJRUZEKD4yqS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 313676c3a932a46489420d08119e1ad1
Files
-
313676c3a932a46489420d08119e1ad1.sys windows:4 windows x86 arch:x86
6c6f851003fc2ff87e7d5172dd25bf7d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
ZwSetValueKey
ObReferenceObjectByHandle
_stricmp
swprintf
wcsstr
_wcslwr
RtlCompareUnicodeString
RtlInitUnicodeString
ZwClose
wcslen
ZwQueryValueKey
ZwOpenKey
_except_handler3
ZwCreateKey
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwDeleteKey
IoDeviceObjectType
PsGetVersion
strncmp
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
wcsncpy
IoGetCurrentProcess
ZwCreateFile
strncpy
PsLookupProcessByProcessId
wcscat
wcscpy
KeTickCount
KeQueryTimeIncrement
_wcsnicmp
ObfDereferenceObject
wcsrchr
MmGetSystemRoutineAddress
PsCreateSystemThread
_snwprintf
PsSetCreateProcessNotifyRoutine
_wcsicmp
ZwSetInformationFile
IofCompleteRequest
RtlCopyUnicodeString
wcschr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 53B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ