Static task
static1
General
-
Target
f7cc4efb748227c057655863497f3703
-
Size
7KB
-
MD5
f7cc4efb748227c057655863497f3703
-
SHA1
b051b362c5b287670cc295b0648306ba904bbb37
-
SHA256
38a3170c8f1507062a7befb061106cb212bf4526c84673233d507a8715958564
-
SHA512
fd606b53811111ea001ada67b9bc70df9f8fc54c6bd0559e6517c824621ee540daecda13f9ed8d401ad9f6467e6b937d73e3c36e48684ffb5e6b60cbe05bfd42
-
SSDEEP
192:4IENa2+Lqxjfev5hkldLmt82GHKk1fGWaTWSP:9ENWlhhMB+yKm+WaTWSP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7cc4efb748227c057655863497f3703
Files
-
f7cc4efb748227c057655863497f3703.sys windows:4 windows x86 arch:x86
842e1a59c45600473974f593c9096b5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
memset
ZwOpenKey
RtlInitUnicodeString
_except_handler3
ExFreePool
ZwEnumerateKey
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
_strnicmp
strlen
ZwWriteFile
sprintf
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
wcslen
strncmp
IoGetCurrentProcess
PsGetVersion
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IoRegisterDriverReinitialization
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
KeServiceDescriptorTable
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 597B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 960B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 448B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ