Static task
static1
General
-
Target
1742fd825a31e277c64df7f1be214c71
-
Size
7KB
-
MD5
1742fd825a31e277c64df7f1be214c71
-
SHA1
0efe16f27050b3d096b0584e982810d9beadcb5f
-
SHA256
49e69f16b1fcf3e9475138d2d8695aa5bbf9cb6c842dfa04cf00e8c979a9b402
-
SHA512
f1e9bbdf8b30dd3a5e813ba12d997e38f12bcdd4fcbe0803023088c50c76bbb04ef5c5addeeb60e063ab704bae77a3366f08fed43e75fbc7733896f4980e4be9
-
SSDEEP
192:P8bS2ocKWqdhCTkk182Gj1fxWaTWwp4K:Uby1dhokMMpWaTWwT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1742fd825a31e277c64df7f1be214c71
Files
-
1742fd825a31e277c64df7f1be214c71.sys windows:4 windows x86 arch:x86
0c9c2dd783b484a27f9144cedd8ba9c0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcsstr
ZwQueryValueKey
memset
ZwOpenKey
RtlInitUnicodeString
_except_handler3
ExFreePool
ZwEnumerateKey
_snwprintf
ExAllocatePoolWithTag
KeDelayExecutionThread
_strnicmp
strlen
ZwWriteFile
sprintf
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
wcslen
strncmp
IoGetCurrentProcess
PsGetVersion
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
IoRegisterDriverReinitialization
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
memcpy
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ZwSetValueKey
KeServiceDescriptorTable
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 576B - Virtual size: 573B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 960B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 448B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ