Static task
static1
General
-
Target
3d5b48e23779ee4c91095aa57ef2c610
-
Size
40KB
-
MD5
3d5b48e23779ee4c91095aa57ef2c610
-
SHA1
444ca55bf2d5b630968f71ab8a64056002f78bdf
-
SHA256
f1273b1d92352280a77110b77eb46c29082b9ca1c89c564c1706f90a6cd90b3c
-
SHA512
900aac7f4c7881eb81791f7d62a9e623416e3696376a3e15ffc29682ecddef1a0060d0c62ddae8709640d72b6aa8fabf36a3d169fbe180bf0bcf3f362d7d064a
-
SSDEEP
768:Dsb/ikCzbHWR/Najg6heskqE2nC2FMSsPOMAWEFVZZ:Dsb/rCzbHWR/mt4ss2ntFMsMXEjZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d5b48e23779ee4c91095aa57ef2c610
Files
-
3d5b48e23779ee4c91095aa57ef2c610.sys windows:4 windows x86 arch:x86
04aeb2870ebf6e524de41ad03ea4e0a1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_wcsicmp
ZwCreateFile
swprintf
RtlCompareUnicodeString
_stricmp
wcsstr
_wcslwr
IoRegisterDriverReinitialization
wcsncpy
wcslen
wcsrchr
MmIsAddressValid
ZwSetInformationFile
wcscpy
KeTickCount
KeQueryTimeIncrement
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwSetValueKey
_except_handler3
ObReferenceObjectByHandle
wcscat
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeQuerySystemTime
RtlAnsiStringToUnicodeString
PsSetCreateProcessNotifyRoutine
ZwDeleteKey
KeDelayExecutionThread
_snwprintf
wcschr
PsCreateSystemThread
PsGetVersion
strncpy
PsLookupProcessByProcessId
ZwCreateKey
MmGetSystemRoutineAddress
IofCompleteRequest
RtlCopyUnicodeString
IoDeviceObjectType
_wcsnicmp
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 60B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ