Static task
static1
General
-
Target
6dd6982bd99644c7abf8cede99d418b1
-
Size
56KB
-
MD5
6dd6982bd99644c7abf8cede99d418b1
-
SHA1
a5488a92b82e9e4b6e03e405400a8babe1f17670
-
SHA256
942ed8ae6b2dcde373099158ccb9d4d7f20c901e514e698a0d8d6f9927b30eea
-
SHA512
b8aae5495968d1b667f25c976475ef42e7c7b6d9e4a4e53a6d6d6a7e3ed91f88166e40042981ea19fd8b3fb71702586dec146d204f1ef3925e00b5ba821813da
-
SSDEEP
1536:TWe0s1PoA8VfiITC6gvJN+/RMmpGNB0OzUxbJgyP:P0sdoA4iaJgvqbpGNB0OQduyP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6dd6982bd99644c7abf8cede99d418b1
Files
-
6dd6982bd99644c7abf8cede99d418b1.sys windows:4 windows x86 arch:x86
1509a1e0c2eb5e05fd807383fc2a5124
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoGetCurrentProcess
KeDelayExecutionThread
PsCreateSystemThread
ZwClose
ZwSetValueKey
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcsstr
_except_handler3
ZwDeleteValueKey
MmGetSystemRoutineAddress
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
PsGetVersion
ExFreePool
ExAllocatePoolWithTag
wcscpy
ZwEnumerateKey
wcscat
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
_strnicmp
IoRegisterDriverReinitialization
RtlCopyUnicodeString
wcsncmp
towlower
strncmp
strncpy
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 192B - Virtual size: 187B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ