Static task
static1
General
-
Target
3958c5c90959427590dc691a27b03ffc
-
Size
7KB
-
MD5
3958c5c90959427590dc691a27b03ffc
-
SHA1
8fc8272ccf05fb1fb58035f11daae708c8e610fe
-
SHA256
cab02af807bf2a50d8c577e532bc72ccb936fc1def20426c2192a7870dcedf28
-
SHA512
ab598968b2b7f1f69c832b3f3362488aabc2fb505c24855d42371ad48c3d137a622d03f5262fc5ac758e517fcaf89eca73460bf150d76ce1398fbf7cac0955c1
-
SSDEEP
192:JekNhE7twhItiXsC6LtBtHIsMYW0lG9PTI6A:JNAwE9BtYIlcb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3958c5c90959427590dc691a27b03ffc
Files
-
3958c5c90959427590dc691a27b03ffc.sys windows:5 windows x86 arch:x86
8867ef4065cfa7529bddacb7e100ef57
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
MmMapLockedPagesSpecifyCache
memset
ObReferenceObjectByName
IoDeleteSymbolicLink
IoDeleteDevice
ZwSetValueKey
ZwClose
IofCompleteRequest
PsGetVersion
KeServiceDescriptorTable
IoCreateSymbolicLink
ExFreePoolWithTag
strlen
swprintf
wcsrchr
ObReferenceObjectByHandle
MmIsAddressValid
ObfDereferenceObject
RtlMultiByteToUnicodeN
wcscpy
ZwOpenKey
_wcsnicmp
IoGetCurrentProcess
ObReferenceObjectByPointer
ExAllocatePoolWithTag
IoCreateDevice
memcpy
_except_handler3
hal
KfRaiseIrql
KfLowerIrql
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 800B - Virtual size: 800B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 592B - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ