Static task
static1
General
-
Target
15f7a478fa969c9756bf12d18cb530e8
-
Size
28KB
-
MD5
15f7a478fa969c9756bf12d18cb530e8
-
SHA1
9323a45092c4b45a8be2368b7858b3ab87a5b36c
-
SHA256
28463c5767244b48c02f3bf24471c9f3a903ad8a7245dd5570199a31c3ebb2db
-
SHA512
103ab2ddef785e14068e4f0712e4f7d76da14ffb04dfb2e1f80e61e05e1c55a2de16187f43f85500624f3f15632566bce83ae3fe096cbf4f274dfb8d4e92f912
-
SSDEEP
768:+6ObE5qrzOXEWePEhHrmfRUHF6Jjh34j:FqrzO0hEwfRUHF6734j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15f7a478fa969c9756bf12d18cb530e8
Files
-
15f7a478fa969c9756bf12d18cb530e8.sys windows:4 windows x86 arch:x86
f0be6a7b39cc6de7910855df569126ab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcslen
swprintf
RtlInitUnicodeString
wcscat
wcscpy
_stricmp
strncpy
RtlCopyUnicodeString
_strnicmp
_wcsnicmp
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
MmIsAddressValid
_except_handler3
ZwUnmapViewOfSection
IoGetCurrentProcess
strncmp
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ObfDereferenceObject
ObQueryNameString
RtlAnsiStringToUnicodeString
IofCompleteRequest
MmGetSystemRoutineAddress
RtlCompareUnicodeString
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 686B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ