Static task
static1
General
-
Target
04d7fb0028231637dc77daaaf5e472e8
-
Size
36KB
-
MD5
04d7fb0028231637dc77daaaf5e472e8
-
SHA1
8168ada6ed5029cad87508f786d9f6bf5ac5389e
-
SHA256
e7ca11e03a1e50f93c49fe4f2b0abc67307fd73d0c9b874e3c4a4b482b03c4f3
-
SHA512
b2eaceb79dea59f69d7aac84d2b9c9c8f0f3b9e70ea8255a47777406220ba175932425cc2c026a6e595b40e19fb18d255e7cf6ac1e4c92268b6b122c144b70be
-
SSDEEP
768:sXgeFyklLCGrV//mKQ5UpfqsH4aJtpv21NMBr12J5JJnr03qoc:sXgeFFlOGr9/m0pfqPqpYNacJfJr03qo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04d7fb0028231637dc77daaaf5e472e8
Files
-
04d7fb0028231637dc77daaaf5e472e8.sys windows:4 windows x86 arch:x86
b1be3ae62722a24e18d79aa083160050
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcslen
ZwCreateKey
RtlInitUnicodeString
swprintf
wcsncpy
wcsrchr
_stricmp
wcsstr
_wcslwr
ZwSetValueKey
PsCreateSystemThread
PsSetCreateProcessNotifyRoutine
_wcsicmp
RtlCompareUnicodeString
ZwCreateFile
MmIsAddressValid
IofCompleteRequest
ZwDeleteKey
ZwOpenKey
MmGetSystemRoutineAddress
strncmp
ObReferenceObjectByHandle
strncpy
PsLookupProcessByProcessId
wcscat
wcscpy
KeTickCount
ZwQueryValueKey
_except_handler3
KeQueryTimeIncrement
RtlCopyUnicodeString
_snwprintf
wcschr
_wcsnicmp
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
KeDelayExecutionThread
KeQuerySystemTime
IoRegisterDriverReinitialization
_snprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoGetCurrentProcess
ZwSetInformationFile
RtlAnsiStringToUnicodeString
IoDeviceObjectType
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ