Static task
static1
General
-
Target
174ccf872c4346f039ea5092a0511f05
-
Size
21KB
-
MD5
174ccf872c4346f039ea5092a0511f05
-
SHA1
b29d8a6495b29140f69342654ab642a4339159e4
-
SHA256
0b4892e7cdecdd06f01c5bdc27a8a535bf4df348ea4e23a91dfe4f0f426dfca6
-
SHA512
3890ce0bdb063b45c142964b84c0e8a234bc731741ccb778209b9f6b0a109ac87741a6097fb4a158930facea809408860c8d92ca15c246e3ccb6db359232d4fe
-
SSDEEP
384:cfIWcQBUR6nnx/V4QCuBw80E2tXxH61ylQ9Vsxkimwqeq+nJz+Sjpo7Qtu:cfIFQBUR6nnxrCuBl0E2tXxaIWBimneB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 174ccf872c4346f039ea5092a0511f05
Files
-
174ccf872c4346f039ea5092a0511f05.sys windows:5 windows x86 arch:x86
449391a0502a393f3ff82be29883c3f4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
RtlInitUnicodeString
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
swprintf
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
MmIsAddressValid
PsGetVersion
_wcslwr
wcsncpy
ZwCreateKey
wcslen
wcscat
wcscpy
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwCreateFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
RtlAnsiStringToUnicodeString
IoRegisterDriverReinitialization
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwUnmapViewOfSection
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 958B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 630B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ