Static task
static1
General
-
Target
5d88434a32f9174a563a9be396b348f0
-
Size
39KB
-
MD5
5d88434a32f9174a563a9be396b348f0
-
SHA1
ae4b9333e5c4797d75877084e12696f16d09aecb
-
SHA256
7bf3059c3a934aada7a2c3ee3d422b164ea2d1834779a07bbf432c7831f2dd3f
-
SHA512
b71f0331f37f643f8bc16b1d5757acdc1a5d5140adc06a51de47e941e278ab7327bc0ec81fe72d4b01b63eec53d683be0b8ccaa3faa986cc043307712d6f7646
-
SSDEEP
768:COipUWuK3gXrIlXda8ufSe9jxpKnsZvVl7KiUHSE9YaNXrvN9DTxpWolVjK:IUj+g0lXda8ufvAnsZvVlWiUHSE9pN7L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d88434a32f9174a563a9be396b348f0
Files
-
5d88434a32f9174a563a9be396b348f0.sys windows:4 windows x86 arch:x86
f096e9ebf4354852b74180e4b7a99322
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
RtlInitUnicodeString
ZwSetValueKey
strncmp
IoGetCurrentProcess
MmIsAddressValid
MmGetSystemRoutineAddress
wcslen
wcscat
wcscpy
_wcsicmp
ZwQueryValueKey
ZwOpenKey
_except_handler3
ObReferenceObjectByHandle
IoRegisterDriverReinitialization
IofCompleteRequest
_wcsnicmp
ObfDereferenceObject
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwDeleteKey
wcsstr
_wcslwr
RtlCopyUnicodeString
PsSetCreateProcessNotifyRoutine
RtlCompareUnicodeString
ZwSetInformationFile
ZwCreateFile
swprintf
strncpy
PsCreateSystemThread
_snwprintf
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
_stricmp
KeTickCount
KeQueryTimeIncrement
wcsncpy
wcsrchr
wcschr
IoDeviceObjectType
ZwCreateKey
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsGetVersion
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ