Static task
static1
General
-
Target
04d94210f4e6ce85ba6b89e9008c7642
-
Size
40KB
-
MD5
04d94210f4e6ce85ba6b89e9008c7642
-
SHA1
6eaa74bc23cfca6ed4ef3c98c493d966ab3c0974
-
SHA256
e6e2fb61903a21bfe169083321faeee0b52d34f58b4f7fd192d56b92f51e1cf1
-
SHA512
97592b7023899cc4237cc44d56eee0fa66b714f29eb62e322db13dc1953cec60c14378588527ebba89819ba743b6f2cddabe6585390a06b9264b153e4737faaf
-
SSDEEP
768:J2G+eow6w67ba7YHvjmidFskJcAjg6uUYOiWOdfXZaZJjf+BdcFisUxxfaNM4GDe:Jp+eB6pkobdykJcAyUYODOjIL8cFisUS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04d94210f4e6ce85ba6b89e9008c7642
Files
-
04d94210f4e6ce85ba6b89e9008c7642.sys windows:4 windows x86 arch:x86
a1f5972a0e737e49f91b94f975661822
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDelayExecutionThread
KeQuerySystemTime
wcslen
swprintf
wcscat
wcscpy
RtlInitUnicodeString
ZwSetValueKey
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
_except_handler3
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
MmIsAddressValid
IoDeviceObjectType
ZwCreateKey
MmGetSystemRoutineAddress
_wcsicmp
_stricmp
wcsstr
_wcslwr
strncmp
ZwSetInformationFile
ZwCreateFile
IoGetCurrentProcess
wcsncpy
PsGetVersion
ObReferenceObjectByHandle
ZwDeleteKey
_wcsnicmp
_snwprintf
wcschr
wcsrchr
PsCreateSystemThread
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
PsSetCreateProcessNotifyRoutine
strncpy
PsLookupProcessByProcessId
_snprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 49B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ