Static task
static1
General
-
Target
756d07a8c1f21a9471cfad6f3a06f06f
-
Size
34KB
-
MD5
756d07a8c1f21a9471cfad6f3a06f06f
-
SHA1
961b036e6a9ec75b289070932c8a56435cbb3f93
-
SHA256
e1f744d4a29e9f554fb81bb38134fe26e005f161e9a3b704ba11a69cf742f896
-
SHA512
430d774ff235581317e703b583408e8c16813a874011b1a4fafc5ab941c59de2749546e4b5faeef3ce40edaa7c2b2fed5fab4934beee600e7bba58464f681bfa
-
SSDEEP
768:F055rJd+2RvjPjkMa7DMKqvL5Gs/o2+/7Cj3u62aa:F0xfRvjLoHqvbo2eOjZ2h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 756d07a8c1f21a9471cfad6f3a06f06f
Files
-
756d07a8c1f21a9471cfad6f3a06f06f.sys windows:6 windows x86 arch:x86
0bffabb56691dd1c30998e3c3810b0ca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwClose
IoAllocateWorkItem
IoCreateSymbolicLink
IoCreateDevice
ZwQueryValueKey
ExAllocatePool
ZwOpenKey
RtlAppendUnicodeToString
KeQueryActiveProcessors
KeGetCurrentThread
KeDelayExecutionThread
KeInsertQueueApc
KeInitializeApc
ZwOpenThread
KeDetachProcess
ZwAllocateVirtualMemory
KeAttachProcess
PsSetCreateThreadNotifyRoutine
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenSection
MmGetPhysicalAddress
KeUnstackDetachProcess
KeStackAttachProcess
IoDeleteDevice
ObOpenObjectByPointer
PsProcessType
ObfDereferenceObject
PsLookupProcessByProcessId
memset
memcpy
PsLookupThreadByThreadId
KeWaitForSingleObject
KeReleaseSemaphore
KeClearEvent
KeSetEvent
KeInitializeEvent
_allmul
PsGetCurrentThreadId
PsGetCurrentProcessId
MmAllocateContiguousMemory
ZwWaitForSingleObject
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
KeTickCount
KeBugCheckEx
RtlUnwind
IoDeleteSymbolicLink
ExFreePoolWithTag
IofCompleteRequest
ObReferenceObjectByHandle
DbgPrint
hal
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KfRaiseIrql
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ