Static task
static1
General
-
Target
062a249f4636befacf49810711010b9b
-
Size
17KB
-
MD5
062a249f4636befacf49810711010b9b
-
SHA1
87316a3969938a5b3b0d72f36a31a6a67eb6570e
-
SHA256
8e2c1add8392e299a504670c6884b05da42f512d4e26d257878f036260c3dc59
-
SHA512
36fdd608baeef50a76ae86bb4fded2c4d20b0552f9fae62b74926b66f1ddee976f2c8fde9c2bcffcb2ac653bac81ec4e055bd6f543ebc2305306c40bb1476768
-
SSDEEP
384:UaM4/HV4t0PYigrCHf8rBetAAN1diTkOALbDLXuDoyh:UaM4/HQ0PYzuHyg1diAxbDyD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 062a249f4636befacf49810711010b9b
Files
-
062a249f4636befacf49810711010b9b.sys windows:4 windows x86 arch:x86
5de55c34fcd485747fcc206559f55cd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
swprintf
isdigit
srand
strchr
RtlInitUnicodeString
isupper
isxdigit
atoi
islower
atol
isprint
tolower
strrchr
MmIsAddressValid
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
_stricmp
strstr
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
ZwCreateFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
ZwUnmapViewOfSection
RtlAnsiStringToUnicodeString
ZwCreateKey
toupper
wcscat
wcscpy
_wcslwr
wcsncpy
PsGetVersion
IoRegisterDriverReinitialization
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
isspace
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 832B - Virtual size: 802B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ