Static task
static1
General
-
Target
0624a845da526007fd6281902e02533d
-
Size
21KB
-
MD5
0624a845da526007fd6281902e02533d
-
SHA1
867901c0243a277fc8fd1f3a887af714d7f7b656
-
SHA256
d6e1acc07f229953d4f8c30e14df43e694fd5cd6211e05e49d8e8f03b4004390
-
SHA512
a852aacfa2870b199ddce52aad9131b6121fa00d4531a083faa40f1e772875150d22c3a48290a585e76eb5f3a38f2ba4b7bd20e3bb33b6186a46a023672171a1
-
SSDEEP
384:9cqXeJ4ikKcA7tls/dLzt+xusjITbBZF7PW5QKGNAg+Ex:9JCfkKX3s/Vzt+xumITFZFrWDsgEx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0624a845da526007fd6281902e02533d
Files
-
0624a845da526007fd6281902e02533d.sys windows:6 windows x86 arch:x86
b351a7ca275e86eb27a03b750312d4b2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
NtBuildNumber
RtlInitUnicodeString
memset
PsLookupProcessByProcessId
IofCompleteRequest
ExFreePoolWithTag
ZwClose
ExAllocatePool
_except_handler3
memcpy
PsSetCreateProcessNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwQuerySystemInformation
ObReferenceObjectByHandle
ZwOpenThread
ObfReferenceObject
ObfDereferenceObject
IoFreeMdl
KeInsertQueueApc
KeInitializeApc
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
MmProbeAndLockPages
wcsncmp
ObOpenObjectByName
wcsstr
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
ZwQueryDirectoryObject
ZwOpenDirectoryObject
KeReleaseMutex
KeWaitForSingleObject
ExAllocatePoolWithTag
MmIsAddressValid
IoRegisterFsRegistrationChange
KeInitializeMutex
IoAllocateMdl
hal
KfLowerIrql
KfRaiseIrql
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 896B - Virtual size: 842B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ