Static task
static1
General
-
Target
06f4627188e11e1344c53c43a6d73623
-
Size
52KB
-
MD5
06f4627188e11e1344c53c43a6d73623
-
SHA1
496d07b26962cae76b7917af5116dae399bc5578
-
SHA256
7493b351d7296996093bfb757691819f44b565ab0065b6fe00a1e46ceb502b10
-
SHA512
4c11f55ad703dc2a63a0ba32f6cea565d3fcedf816e435f17ebc91f0f431997b28c1a68ddb7242668801978a830b49e1f33714a2a02df19617ffa821a0c3d1e0
-
SSDEEP
768:40diCQZwBKpIiehMRYaCFDBA9ZNsqhinRDIs5GU+wV9sLMASm0T/MZf:40dVQZwQpIiZGQPg7ZQolMp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06f4627188e11e1344c53c43a6d73623
Files
-
06f4627188e11e1344c53c43a6d73623.sys windows:4 windows x86 arch:x86
ae4e1b0c7f05cd2da6c8fac282cde108
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
wcsncmp
wcslen
towlower
MmGetSystemRoutineAddress
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
ZwSetValueKey
PsGetVersion
ExFreePool
ExAllocatePoolWithTag
KeDelayExecutionThread
PsCreateSystemThread
ZwQueryValueKey
ZwOpenKey
_except_handler3
wcsstr
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
strncmp
strncpy
wcscpy
ZwEnumerateKey
wcscat
_strnicmp
ZwDeleteValueKey
IofCompleteRequest
RtlCopyUnicodeString
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 160B - Virtual size: 153B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ