Static task
static1
General
-
Target
64d34ffa7b882fc46a241706f75cafa6
-
Size
28KB
-
MD5
64d34ffa7b882fc46a241706f75cafa6
-
SHA1
bf9db5f1c0393cc9b24033733101abc476f99275
-
SHA256
73feb67f502e64c82fdaa4ea6bade98b87f0b34bfc43c35a1a2199826b762422
-
SHA512
db1d3ff5fa502c365763a28ac335c4fa132e319b817b26c99dadb059299f9f4779fa5b8f826444cfcb7d1706a02e88fd9136245d1f41d624d29f959263c729da
-
SSDEEP
768:f0y1md6TBQbuQYLqE+mUuE4ck+mOWBSN7cqiZIikYHUl1FU:MyEU6Y29mUIywSWhOxYK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64d34ffa7b882fc46a241706f75cafa6
Files
-
64d34ffa7b882fc46a241706f75cafa6.sys windows:4 windows x86 arch:x86
9e6764fed29323ea98118ccad97e8b71
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
swprintf
ZwClose
RtlInitUnicodeString
ZwOpenKey
wcslen
wcscat
wcscpy
_except_handler3
strncmp
ObfDereferenceObject
strncpy
_strnicmp
MmGetSystemRoutineAddress
ExFreePool
_snprintf
ExAllocatePoolWithTag
_wcsnicmp
IofCompleteRequest
_stricmp
RtlAnsiStringToUnicodeString
RtlCopyUnicodeString
_itow
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 864B - Virtual size: 850B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ