Static task
static1
General
-
Target
6403ade589236d3af743345ac2360567
-
Size
40KB
-
MD5
6403ade589236d3af743345ac2360567
-
SHA1
36067a816be538cd56ae6fd900ca7ccee2c99ab6
-
SHA256
e49c874b54fb8f689ea22b8a04053ae185b3da74667adbd82c638763c88b1fe3
-
SHA512
bcf7c75b4539638c4aa8dc091764bd86a64b76944a69c03776a92d877ea8f97442e0ae33b54edc8c7603b61d9624fc830d56acf217128ebe29e2b5f30d9dfb59
-
SSDEEP
768:5kCRBfL0Li3wjHWu2Si+PmcKz6iQGOC1w0za/AFE3FDmP3iX:prz0LuKnucKSrCqME3wP32
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6403ade589236d3af743345ac2360567
Files
-
6403ade589236d3af743345ac2360567.sys windows:4 windows x86 arch:x86
c76fe2b77e52b8bae97094ea12f90151
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
_snwprintf
wcsncpy
wcslen
wcschr
IoDeviceObjectType
_wcsicmp
wcsrchr
RtlCompareUnicodeString
RtlInitUnicodeString
swprintf
wcscat
wcscpy
strncpy
PsLookupProcessByProcessId
_stricmp
ZwSetValueKey
ZwClose
PsGetVersion
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
ZwDeleteKey
ZwOpenKey
ZwCreateKey
MmGetSystemRoutineAddress
_wcsnicmp
ObfDereferenceObject
KeTickCount
KeQueryTimeIncrement
ZwCreateFile
ZwQueryValueKey
PsCreateSystemThread
KeQuerySystemTime
_except_handler3
RtlAnsiStringToUnicodeString
IoGetCurrentProcess
wcsstr
_wcslwr
ExFreePool
ObReferenceObjectByHandle
IofCompleteRequest
IoRegisterDriverReinitialization
RtlCopyUnicodeString
strncmp
ZwSetInformationFile
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snprintf
KeDelayExecutionThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 66B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ