Static task
static1
General
-
Target
00f08231b5b009f75d4b655b6ee98737
-
Size
4KB
-
MD5
00f08231b5b009f75d4b655b6ee98737
-
SHA1
395196ef06dcfa76e5919e969b602b205b6a880a
-
SHA256
d8b5e2a22ba49e43872e908876ff023323ac064f50f4744bd8e159aa3f649548
-
SHA512
46234b7033ddb6eaca846b43c5edbe2f2a8158807fedb670f1f75d4362f682016c4f658008f3919bfa1d6ca91fa26ae6eb8e7440054381767cc23de2cd1afc98
-
SSDEEP
48:qeVBU/UKPAB8oQCIa9knitFvunx9tD6ylgP1RViRT:JDa3ToQFamith03Yy3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00f08231b5b009f75d4b655b6ee98737
Files
-
00f08231b5b009f75d4b655b6ee98737.sys windows:5 windows x86 arch:x86
3325a1a4fcabd2c615283d9ae29fc5b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 526B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 256B - Virtual size: 182B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ