Static task
static1
General
-
Target
04655a622a47ba29c68675329a506b5b
-
Size
49KB
-
MD5
04655a622a47ba29c68675329a506b5b
-
SHA1
0332aba2a91ba7686ab61754cfac54ca6d6fad15
-
SHA256
b291641f27f3404dc3d5b162f5da985f1b94cefe7c442a38f02dd2befcdd4be8
-
SHA512
527c3b94f839d01365b6cf96e2744395da71c3590cc9f06e8e91928257fd537596bf925ca764f2791b8770da35fb8f68993ce16a8b2fb5398a157751c0c4067d
-
SSDEEP
768:8rV7TYFvB9CPJIISrSL1RRrvvLSyLctu:+GvyRrv1G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04655a622a47ba29c68675329a506b5b
Files
-
04655a622a47ba29c68675329a506b5b.sys windows:4 windows x86 arch:x86
5b12c4f159137b743e4cd5ab9219449a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwCreateFile
RtlInitUnicodeString
MmIsAddressValid
PsGetVersion
_wcslwr
wcsncpy
IoRegisterDriverReinitialization
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 900B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 736B - Virtual size: 714B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ