Static task
static1
General
-
Target
3cfffc53515264eaec5f2dc31e765558
-
Size
40KB
-
MD5
3cfffc53515264eaec5f2dc31e765558
-
SHA1
7a32b03ec59888181e90c20b51f74b5fb0ab314f
-
SHA256
e1539900dc39b7f7e6cc7fc0967fec66c62b0b08f0f9c2c77ee88c3072602f44
-
SHA512
79d97ef303c7f5bb922cb357b79f6582d7c5af4796f1656bf2fba0035b47a5488cf3f5475c207fcb933a4c42a6b817531503862cbf89d67d6a881836dbc10654
-
SSDEEP
768:lxhRHJaTW35nEeS8exJ+jqsH174HguqxI+fqubjFQeqn+yOff86v6:lxDHAypnE1Nx0OsH17tyaF1q6ff86
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cfffc53515264eaec5f2dc31e765558
Files
-
3cfffc53515264eaec5f2dc31e765558.sys windows:4 windows x86 arch:x86
00e2a03e20b54e3d564bd64ace8b2d9e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
ObReferenceObjectByHandle
RtlInitUnicodeString
strncmp
swprintf
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwClose
ZwOpenKey
KeDelayExecutionThread
KeQuerySystemTime
IofCompleteRequest
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_wcsnicmp
wcslen
ZwCreateKey
ZwQueryValueKey
wcscat
wcscpy
_except_handler3
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
ZwCreateFile
IoRegisterDriverReinitialization
_snwprintf
_wcsicmp
wcsncpy
wcsrchr
MmGetSystemRoutineAddress
wcschr
wcsstr
_wcslwr
KeTickCount
KeQueryTimeIncrement
_stricmp
strncpy
PsLookupProcessByProcessId
MmIsAddressValid
IoDeviceObjectType
RtlCopyUnicodeString
ObfDereferenceObject
IoGetCurrentProcess
RtlCompareUnicodeString
PsCreateSystemThread
RtlAnsiStringToUnicodeString
PsGetVersion
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 63B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ