Static task
static1
General
-
Target
083bba96b92940ec7db29e688b44c6f6
-
Size
47KB
-
MD5
083bba96b92940ec7db29e688b44c6f6
-
SHA1
88438c7cf49e054be3105783c6fcc0a7b848790a
-
SHA256
512a9cecf2ef2ecb26c83cd3d4ed73bf23889a4addcc22a24b4e370f2fe7896a
-
SHA512
d7f2a8cbd5511a8ec08e2adefced9bcf381aa1e93dbef22e3e82e68c88fc151f0140eea7f59ce153da9e8f1774d00d282dc85312a44f90482afe9fc09b8108ed
-
SSDEEP
384:mpCNQDO+szC+OKkSNxKYYhU9RkPv1GLLd2dsrb5n2v8UhL:mpRtszC+OKrxK5CbIv4Qsrtn2v/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 083bba96b92940ec7db29e688b44c6f6
Files
-
083bba96b92940ec7db29e688b44c6f6.sys windows:4 windows x86 arch:x86
2345b657737c4e6c074077541d62394c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlTraceDatabaseUnlock
ZwRestoreKey
NtVdmControl
RtlInsertElementGenericTable
ZwQueryVolumeInformationFile
MmMapMemoryDumpMdl
ZwUnloadDriver
FsRtlMdlReadComplete
NtAdjustPrivilegesToken
SePrivilegeObjectAuditAlarm
KeReadStateQueue
SeDeleteAccessState
Ke386IoSetAccessProcess
FsRtlMdlReadDev
RtlAddAccessAllowedAce
_itow
_vsnprintf
memchr
FsRtlSplitLargeMcb
FsRtlUninitializeFileLock
IoStartNextPacket
MmUnmapVideoDisplay
ZwCreateTimer
ZwCreateDirectoryObject
ZwQueryInformationToken
ExIsResourceAcquiredSharedLite
CcPrepareMdlWrite
NtAllocateUuids
_allshl
InbvCheckDisplayOwnership
RtlCharToInteger
RtlZeroHeap
IoRegisterFsRegistrationChange
KeRestoreFloatingPointState
InitSafeBootMode
InbvSetScrollRegion
MmForceSectionClosed
ZwUnloadDriver
KeI386MachineType
ZwYieldExecution
MmAdjustWorkingSetSize
RtlGetDaclSecurityDescriptor
RtlConvertUlongToLargeInteger
FsRtlLegalAnsiCharacterArray
LpcPortObjectType
_allshr
Kei386EoiHelper
Ke386QueryIoAccessMap
rand
RtlSelfRelativeToAbsoluteSD2
SeAccessCheck
IoCheckQuerySetVolumeInformation
ExfInterlockedPopEntryList
ExWindowStationObjectType
wcsncat
RtlInitializeSid
KeInitializeTimer
ObDereferenceObject
IoInitializeRemoveLockEx
KeInitializeTimer
isupper
SeAssignSecurityEx
IoGetStackLimits
PsRestoreImpersonation
RtlSelfRelativeToAbsoluteSD
CcMdlReadComplete
SeSetSecurityDescriptorInfo
RtlNumberGenericTableElements
KeSetTimeIncrement
FsRtlCheckLockForReadAccess
hal
KeRaiseIrqlToSynchLevel
HalClearSoftwareInterrupt
IoWritePartitionTable
KeGetCurrentIrql
KeQueryPerformanceCounter
KeReleaseSpinLock
HalGetEnvironmentVariable
KeAcquireQueuedSpinLock
HalReturnToFirmware
KeTryToAcquireQueuedSpinLock
HalSetTimeIncrement
HalGetEnvironmentVariable
HalAllocateCrashDumpRegisters
KeAcquireQueuedSpinLockRaiseToSynch
IoReadPartitionTable
HalHandleNMI
HalSystemVectorDispatchEntry
READ_PORT_BUFFER_USHORT
HalSetBusData
KeReleaseQueuedSpinLock
HalSystemVectorDispatchEntry
HalGetBusData
IoWritePartitionTable
KeStallExecutionProcessor
IoSetPartitionInformation
HalSetTimeIncrement
HalQueryRealTimeClock
HalInitSystem
HalReportResourceUsage
HalQueryRealTimeClock
ExReleaseFastMutex
KdComPortInUse
KfLowerIrql
KfReleaseSpinLock
HalSetProfileInterval
IoReadPartitionTable
KeAcquireQueuedSpinLockRaiseToSynch
KeAcquireQueuedSpinLockRaiseToSynch
IoWritePartitionTable
HalSystemVectorDispatchEntry
HalGetInterruptVector
KeAcquireSpinLockRaiseToSynch
WRITE_PORT_BUFFER_USHORT
KeStallExecutionProcessor
HalTranslateBusAddress
KeRaiseIrqlToSynchLevel
HalSetTimeIncrement
ExAcquireFastMutex
READ_PORT_USHORT
HalSetTimeIncrement
HalEndSystemInterrupt
ExReleaseFastMutex
READ_PORT_ULONG
ExReleaseFastMutex
ExReleaseFastMutex
KeStallExecutionProcessor
IoWritePartitionTable
HalSetDisplayParameters
HalSetProfileInterval
IoMapTransfer
HalSetProfileInterval
READ_PORT_BUFFER_ULONG
ExAcquireFastMutex
HalInitializeProcessor
IoSetPartitionInformation
IoFreeMapRegisters
HalAllProcessorsStarted
HalMakeBeep
KfAcquireSpinLock
KdComPortInUse
HalRequestIpi
HalEndSystemInterrupt
IoReadPartitionTable
HalSystemVectorDispatchEntry
IoFlushAdapterBuffers
IoReadPartitionTable
HalTranslateBusAddress
READ_PORT_ULONG
KeRaiseIrqlToDpcLevel
WRITE_PORT_UCHAR
HalReportResourceUsage
IoMapTransfer
HalAssignSlotResources
HalMakeBeep
KeFlushWriteBuffer
HalMakeBeep
HalAcquireDisplayOwnership
KfReleaseSpinLock
KeAcquireSpinLock
HalCalibratePerformanceCounter
HalHandleNMI
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 128B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ