Static task
static1
General
-
Target
79346725509b7598fb771a395b4cffd6
-
Size
7KB
-
MD5
79346725509b7598fb771a395b4cffd6
-
SHA1
72bb8a66247d57856137d6097ee74146ce9466ed
-
SHA256
98bdea03758ea8269500c9737e023b6f16aa12ee72cfcc585bad96292e93a3d2
-
SHA512
d6be856fe8c30c6f8a351940d6606933e2267bd9d293f39511ae18b41050803c792fe13450672a585708261395e4c4a36408a353beea3864dbd4fe635b0321d0
-
SSDEEP
96:ljjEleOp4zzibHLkImzrCK/AX9fI+sM5v0EZZPfTCgWQu:ljjEleOWzzQFG9/UJOw0SNPWQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79346725509b7598fb771a395b4cffd6
Files
-
79346725509b7598fb771a395b4cffd6.sys windows:5 windows x86 arch:x86
cb3670a76bf3784465c9ee4dd3116442
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeEvent
IoCreateDevice
InterlockedDecrement
IofCompleteRequest
ExFreePool
KeSetEvent
KeWaitForSingleObject
IofCallDriver
InterlockedIncrement
IoIsWdmVersionAvailable
RtlCopyUnicodeString
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlInitUnicodeString
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
MmUnmapViewOfSection
PsLookupProcessByProcessId
KeServiceDescriptorTable
ProbeForWrite
IoAttachDeviceToDeviceStack
ZwClose
wcslen
ZwCreateKey
RtlAppendUnicodeToString
RtlFreeUnicodeString
IoSetDeviceInterfaceState
PoCallDriver
PoStartNextPowerIrp
InterlockedExchange
KeClearEvent
KeInitializeSpinLock
_except_handler3
IoRegisterDeviceInterface
IoDetachDevice
ProbeForRead
IoDeleteDevice
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ