Static task
static1
General
-
Target
00fae409a8c2d32cdae21cd599b51495
-
Size
54KB
-
MD5
00fae409a8c2d32cdae21cd599b51495
-
SHA1
492cf65572a227db5b9fca7d51516b926908af4d
-
SHA256
d327d58cda5b08fcc169ea2ae516dd4cdee2a54fcea262bb75b5c24bbdbbabef
-
SHA512
01643f3ee7a20d08967f5529eee1b0cd12f2552e9e35e9b813880c12897e0837eb1936fe83a7ea6d8dedf2f1b5807d14581bc9cb3df857e380629e23e489820f
-
SSDEEP
1536:lkYTkHPF5jXrmbLsQ32m7wq9++C9k5yQlVIAzW02MNd5V5tdYDZZwyCdu:PTkHPFdrmbLsQ3d7wq949k5yQlVIAzW2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00fae409a8c2d32cdae21cd599b51495
Files
-
00fae409a8c2d32cdae21cd599b51495.sys windows:4 windows x86 arch:x86
d9ee6a71d04259d263322711f15aa67b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
wcsncmp
wcslen
towlower
ExFreePool
ZwClose
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
ZwQueryValueKey
ZwOpenKey
_except_handler3
IoRegisterDriverReinitialization
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IofCompleteRequest
IoGetCurrentProcess
wcsstr
wcscpy
ZwEnumerateKey
wcscat
KeDelayExecutionThread
PsCreateSystemThread
RtlCopyUnicodeString
_strnicmp
ZwDeleteValueKey
ZwSetValueKey
strncmp
PsGetVersion
strncpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 288B - Virtual size: 268B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ