Static task
static1
General
-
Target
7beeb5f958d0fd03b3accfa167ec73b8
-
Size
40KB
-
MD5
7beeb5f958d0fd03b3accfa167ec73b8
-
SHA1
466782e9867b5e13e58e2274f759ed879acb9690
-
SHA256
e151c28f98ccf939ca05fb51aad32bf332a0656ab544a89c5a8db7123ed32783
-
SHA512
ba79a6833bea20f77776b60cc48e1c02c11330032b4d80bf063cba3c59483b8e887a48390f824922691e9932ad1538ce3ddee7b335230ddbf832a09c26c9d5ca
-
SSDEEP
768:9qapr7m5YMwxllYSdwz7IajWcgRuGJx7DFMgAW33OW59vFpxVztDbP6nyeXm:g0kYzllYPz8+DmuGJxDi72t9vFHVJDq4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7beeb5f958d0fd03b3accfa167ec73b8
Files
-
7beeb5f958d0fd03b3accfa167ec73b8.sys windows:4 windows x86 arch:x86
1f126c145b3b996d823565a330f9e3e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDelayExecutionThread
KeQuerySystemTime
_wcsicmp
wcsncpy
wcslen
wcsrchr
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
RtlCopyUnicodeString
ZwCreateKey
RtlCompareUnicodeString
MmIsAddressValid
IoDeviceObjectType
PsGetVersion
swprintf
wcscat
wcscpy
IoGetCurrentProcess
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwDeleteKey
_snprintf
_stricmp
wcsstr
_wcslwr
strncmp
_wcsnicmp
ZwCreateFile
strncpy
ZwSetInformationFile
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
ObReferenceObjectByHandle
_snwprintf
wcschr
PsCreateSystemThread
MmGetSystemRoutineAddress
KeTickCount
KeQueryTimeIncrement
PsLookupProcessByProcessId
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ