Static task
static1
General
-
Target
0444b8ec4d5badd4b685fb5a28d34af0
-
Size
40KB
-
MD5
0444b8ec4d5badd4b685fb5a28d34af0
-
SHA1
bc294d1fe9167e9d317afec0ad793cb70f0f2da4
-
SHA256
42a1392d7d97f33092599052abd339908dbe98ffe87912182cde98480eadd199
-
SHA512
6206da5410219e15de8671230321542ebb4bda44c1f22b02e46891a593f7ca46f117cbc2743e793997f368d04a56652aa7ecfc84124dc4da801c82228bf64373
-
SSDEEP
768:b6DfpcOWMXYpQTTqkDkiAAwY38/7uF7fWE7+02FoJ0tHPdRdCWGoq:GfpcOvopQTrDkdliF7h+0pJKPd/CWGp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0444b8ec4d5badd4b685fb5a28d34af0
Files
-
0444b8ec4d5badd4b685fb5a28d34af0.sys windows:4 windows x86 arch:x86
07db5c2d54ef798c04f0f3527777e1f1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCopyUnicodeString
_wcsnicmp
wcslen
RtlInitUnicodeString
ObfDereferenceObject
ZwClose
_snwprintf
wcsncpy
wcschr
ZwSetInformationFile
ZwCreateFile
wcscpy
swprintf
RtlAnsiStringToUnicodeString
ZwDeleteKey
ObReferenceObjectByHandle
wcsstr
_wcslwr
ExFreePool
ExAllocatePoolWithTag
KeDelayExecutionThread
KeQuerySystemTime
_stricmp
ZwSetValueKey
wcscat
ZwQueryValueKey
ZwOpenKey
_except_handler3
PsCreateSystemThread
MmGetSystemRoutineAddress
ZwCreateKey
wcsrchr
RtlCompareUnicodeString
strncmp
IoGetCurrentProcess
PsGetVersion
MmIsAddressValid
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
strncpy
_snprintf
IoRegisterDriverReinitialization
_wcsicmp
IofCompleteRequest
KeTickCount
KeQueryTimeIncrement
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 73B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ