Static task
static1
General
-
Target
3b378cbdd29400f45930c329be88d0a3
-
Size
40KB
-
MD5
3b378cbdd29400f45930c329be88d0a3
-
SHA1
cec44e27a3f12b2b4e66ae1624f6bbe4f587cd40
-
SHA256
fc8690f4aedd6363a5cd55d4d2b4e62ad2ba2efa9f976c0bca9bdf91104ab05c
-
SHA512
688ff80494db3cb63d274fceac209e58c1a876f6851be743b8f1f943a4f0d3b752daa475f173cf45c310e6a748ae581dde725784027b3d89af6f676e0a9fc384
-
SSDEEP
768:ANUBioagA7sQmkRHspYGNm1aiCTlc/sM+UvbUvJuVguxhDNtEfC0dNsApk:AdoZATspYQNZc/sMpvbsJ8guTNtEa+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b378cbdd29400f45930c329be88d0a3
Files
-
3b378cbdd29400f45930c329be88d0a3.sys windows:4 windows x86 arch:x86
80e556bc9f435c2a72b7ca8c3ff12022
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeTickCount
KeQueryTimeIncrement
_stricmp
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
RtlInitUnicodeString
ZwSetValueKey
ObReferenceObjectByHandle
strncpy
PsLookupProcessByProcessId
IofCompleteRequest
ZwClose
PsCreateSystemThread
strncmp
swprintf
wcsstr
_wcslwr
KeDelayExecutionThread
KeQuerySystemTime
RtlCompareUnicodeString
ZwOpenKey
ObfDereferenceObject
_wcsnicmp
wcslen
ZwDeleteKey
ZwCreateFile
RtlCopyUnicodeString
wcscat
wcscpy
_wcsicmp
wcsrchr
ExFreePool
_snprintf
ExAllocatePoolWithTag
IoRegisterDriverReinitialization
ZwSetInformationFile
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwCreateKey
_except_handler3
MmGetSystemRoutineAddress
_snwprintf
wcschr
RtlAnsiStringToUnicodeString
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 92B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ