Static task
static1
General
-
Target
03ff89d1b1cb5c0265da06fdc54bbb0b
-
Size
20KB
-
MD5
03ff89d1b1cb5c0265da06fdc54bbb0b
-
SHA1
d4e1972f6e088a78423b2dbbb0abf47e04becf2d
-
SHA256
8e6db6eac2cad57ddf4f3a6fb1a68c6d8d788e2e886012c2bfb2392ef7dc06d6
-
SHA512
852a34a84de84000f39492a3da481af254702ccfcb4f6751b8ba7981001b30089bd47936e36644f615bf7a1ccd69887ee04faae7e0de93cf502b1061aabcfb1d
-
SSDEEP
384:xRRnNKDb1FZTAbfXY/acTElCujeJBAjMHsIpiKnE4T7pYF4u3UVaDwBt3oZSbMte:ZNKDbhAbfXY/JtsIpiKE4T7pYF4u3UV4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03ff89d1b1cb5c0265da06fdc54bbb0b
Files
-
03ff89d1b1cb5c0265da06fdc54bbb0b.sys windows:4 windows x86 arch:x86
5740d200fbf4837ee0f019f97861a3aa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
_except_handler3
_wcsnicmp
wcslen
RtlCompareUnicodeString
RtlInitUnicodeString
ExGetPreviousMode
_stricmp
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
ZwSetValueKey
strstr
ZwQueryValueKey
ZwClose
ExFreePool
ZwCreateKey
wcscat
wcscpy
ExAllocatePoolWithTag
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwOpenKey
KeServiceDescriptorTable
PsGetVersion
_snwprintf
ZwEnumerateKey
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
ZwCreateFile
IofCompleteRequest
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
ZwWriteFile
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 902B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ