Static task
static1
General
-
Target
09fdde5f380f39610b45d2baf5453b5d
-
Size
20KB
-
MD5
09fdde5f380f39610b45d2baf5453b5d
-
SHA1
0519f7c69a7d5949e868372d078cef25553cacd1
-
SHA256
92e5b0d66bee4515291158b53381297e9f54e9a001ddfc28dcdc3c1f25e5d9b4
-
SHA512
53ff7ef7e6d601ab846efee9f5f57083bb008bfdc2cd1d73eb2cfaccb01e1c44fd8303aa8c68eb530a2f4f9a62e4c69ed3325112fbbea4fdecbbdbd71bc65cad
-
SSDEEP
384:ZncBMlQMQZdBmgQiwYivkgTpVPMpdY0DAJ/XF8ZETwnt/bNvQ:OBMlQM+mMUkgT303Y08Mrhv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09fdde5f380f39610b45d2baf5453b5d
Files
-
09fdde5f380f39610b45d2baf5453b5d.sys windows:5 windows x86 arch:x86
c309c5ff2a129706dbda3f6ab5c2c3ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
KeTickCount
MmMapLockedPagesSpecifyCache
IoFreeMdl
IoReleaseCancelSpinLock
RtlUnicodeStringToInteger
IoDeleteDevice
IoCreateSymbolicLink
KeInitializeSpinLock
IofCompleteRequest
RtlInitUnicodeString
IoDeleteSymbolicLink
MmGetSystemRoutineAddress
wcslen
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
ExFreePoolWithTag
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
ExAllocatePoolWithTag
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisUnchainBufferAtFront
NdisFreePacket
NdisReturnPackets
NdisAllocatePacket
NdisReadConfiguration
NdisCloseConfiguration
NdisAllocateMemoryWithTag
NdisAllocatePacketPoolEx
NdisAllocateBufferPool
NdisCancelSendPackets
NdisOpenProtocolConfiguration
NdisAllocateBuffer
NdisFreeMemory
NdisWaitEvent
NdisGeneratePartialCancelId
NdisRegisterProtocol
NdisInitializeEvent
NdisSetEvent
NdisFreeBufferPool
NdisFreePacketPool
NdisQueryPendingIOCount
NdisDeregisterProtocol
NdisRequest
NdisCloseAdapter
NdisQueryAdapterInstanceName
NdisOpenAdapter
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 484B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 926B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ