Static task
static1
General
-
Target
4de808b599b9c386fd3313c1975a8af6
-
Size
18KB
-
MD5
4de808b599b9c386fd3313c1975a8af6
-
SHA1
53df150206b044057b2f4c7f0a60a59ba3a3d6c1
-
SHA256
45c67995d2a45309f23f052e590bbe5eacf2f2ac1797b3c518a4523fc61f6983
-
SHA512
581731b8c965d7b545b49793d94c74e3f38d93bcbf1a30c146750643f4a3e599f0069e3eafcb175df2abd99250421f31b5bc4e3825b44ca0ac8bd08869fa25bb
-
SSDEEP
384:v9v3EyuvymG9yShEwkwUqXLKnyYMepQH0PBGZui2eMwHbZ7wvVF4N09z3b71+zV2:1CGC+JZl2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4de808b599b9c386fd3313c1975a8af6
Files
-
4de808b599b9c386fd3313c1975a8af6.sys windows:5 windows x86 arch:x86
1c8913c1b0f1276e22a04a870ce57797
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_except_handler3
_stricmp
IofCompleteRequest
PsGetCurrentProcessId
_strupr
IoGetCurrentProcess
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
PsSetLoadImageNotifyRoutine
ProbeForRead
ExAllocatePoolWithTag
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
ZwQueryInformationProcess
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
MmSizeOfMdl
PsTerminateSystemThread
ProbeForWrite
MmIsAddressValid
ExFreePool
ExGetPreviousMode
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zcata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
vcata Size: 544B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 382B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ