Static task
static1
General
-
Target
05f8f92ffa8aac29103cb03ee63ae941
-
Size
28KB
-
MD5
05f8f92ffa8aac29103cb03ee63ae941
-
SHA1
6fd30baa6cfb7b24a4f829aa5ec2a295d6d04c86
-
SHA256
eaf16f2bb97f76a30b2637da6cdf3f1541122cb0fb9fcf9501b24a1b15661605
-
SHA512
fe4e9e09bcf98e26831ed01b0d2461014fb9919310ab322c5f64b2c79b517224da17d282f927d23f799fb6c41a6d4ca568fa3b39125a8689cfb0c8a2a4f84744
-
SSDEEP
768:0wi+WVaFCjaKIXnkRrrMOqtwARIrIq+XLRyU6MY7ai:ni+jCja9Xn23MOqtwqeunVi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05f8f92ffa8aac29103cb03ee63ae941
Files
-
05f8f92ffa8aac29103cb03ee63ae941.sys windows:4 windows x86 arch:x86
08f7f32266441efe4630aaa10fd0003c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
wcscat
wcscpy
_itow
swprintf
RtlInitUnicodeString
ZwClose
ZwOpenKey
ObfDereferenceObject
MmGetSystemRoutineAddress
_strnicmp
RtlAnsiStringToUnicodeString
strncpy
strncmp
_wcsnicmp
RtlCopyUnicodeString
IofCompleteRequest
_stricmp
_except_handler3
ExFreePool
_snprintf
ExAllocatePoolWithTag
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 890B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ