Static task
static1
General
-
Target
1111b144448494486cd06a3efd09f43d
-
Size
40KB
-
MD5
1111b144448494486cd06a3efd09f43d
-
SHA1
34128557886ed832a4afb7b7b5287297f78eedbc
-
SHA256
e1bf712ab7ba9ce4b8e947789789d9cd98bf5bd56e5e7a9ffd4aedf051e4bb2e
-
SHA512
323dd89a5c193221f5fe8b9ffbfb09df255a6ba9f0dd5d9e5c4adcb752419e5676b16dfc6e8764c8cd0e4bdabc1d715339b278006e17e987d42e5d4be1cd2950
-
SSDEEP
768:L/CjfiNz/+w7tMIYeLH8MS1w9mxKoAPA+o2a/MzSIHlLejrbVs9Gf4u8giAY+:L5V/+w5MTA1S1Albo2aoHlLeHm9Gf4uv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1111b144448494486cd06a3efd09f43d
Files
-
1111b144448494486cd06a3efd09f43d.sys windows:4 windows x86 arch:x86
3809691f3e4c0e8d06feb010f7df6fd4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snwprintf
ExAllocatePoolWithTag
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
PsSetCreateProcessNotifyRoutine
ZwClose
ZwCreateFile
swprintf
ZwSetValueKey
ObReferenceObjectByHandle
RtlCompareUnicodeString
ZwOpenKey
IoRegisterDriverReinitialization
ZwDeleteKey
ObfDereferenceObject
wcslen
ZwCreateKey
wcsrchr
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
_stricmp
ExFreePool
strncmp
_wcsnicmp
_except_handler3
RtlCopyUnicodeString
IofCompleteRequest
KeQuerySystemTime
_wcsicmp
KeDelayExecutionThread
wcsstr
_wcslwr
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
wcscat
wcscpy
ZwSetInformationFile
wcschr
MmGetSystemRoutineAddress
IoDeviceObjectType
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ