Static task
static1
General
-
Target
18c71b42e1a2695f198052c8b302075c
-
Size
63KB
-
MD5
18c71b42e1a2695f198052c8b302075c
-
SHA1
590dcb49a49cbf805a0ed464fd3a19931d037583
-
SHA256
05f51cbb57cfcb24381d086c1d8edddab95e84662e6c496db42db092b784ca54
-
SHA512
e580e8db17937d0f57542a08cd9f2f87449c94e24b0a0905e963219a4a0eaf4f5c41dd4e1378111b247414fb6ca44368f4592b9894a93ade318eafba7ebcb6e4
-
SSDEEP
384:rAsEpp7k6YD6Gop6oQlKHsxm2qGqa1rNn8TI0zUpyyHAeaMqA0RYjdA/DTEqHPQ1:zEz7f6top6G4cIFcFOa7iOli
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18c71b42e1a2695f198052c8b302075c
Files
-
18c71b42e1a2695f198052c8b302075c.sys windows:5 windows x86 arch:x86
e56d44093d2a69ccb2bfb49338de69aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwQuerySystemInformation
KeServiceDescriptorTable
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
KeInitializeSpinLock
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ExAllocatePoolWithTag
ObReferenceObjectByHandle
ZwOpenProcess
wcslen
strncmp
IoGetCurrentProcess
MmIsAddressValid
PsGetCurrentProcessId
MmUserProbeAddress
NtBuildNumber
KeBugCheck
KeTickCount
KeBugCheckEx
strrchr
_stricmp
IoCreateFile
ExFreePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adong Size: 121B - Virtual size: 121B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
520mmym Size: 17B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE