Static task
static1
General
-
Target
19ee6f440cf546432d0f9a7ddd0d6001
-
Size
10KB
-
MD5
19ee6f440cf546432d0f9a7ddd0d6001
-
SHA1
176905537180dcdc77d93439476978251d3357b7
-
SHA256
087a17957c67e518c6e84ba7c3ffd561aa2f0d80eca25756b75936ff4f917bef
-
SHA512
9561c0e61c566f343e47045a5ac5c671b1ec4500f2ca3520bcaaaa38c15c05f24a509b80f6266242bfb450aa8af72b3f8914e89c739c6d22ae096b7c03fc3860
-
SSDEEP
192:BB9B5J58t3cZIojHwS6H3svmbf5SD8Vr6GNNZ7m47YBtjp5kpyvhy00:BB9B5J58eZIo0sv8xSD8Vr/a47mp5kp2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19ee6f440cf546432d0f9a7ddd0d6001
Files
-
19ee6f440cf546432d0f9a7ddd0d6001.sys windows:5 windows x86 arch:x86
2bab89b64be86afecb6e6ba415f1f98e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeSetEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlInitUnicodeString
IoGetConfigurationInformation
IoGetDeviceObjectPointer
IoFreeIrp
IoFreeMdl
MmUnlockPages
IofCallDriver
KeGetCurrentThread
MmProbeAndLockPages
ExFreePool
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
ExAllocatePoolWithTag
_except_handler3
KeWaitForSingleObject
ZwClose
IoDeleteSymbolicLink
IofCompleteRequest
ExfInterlockedInsertTailList
_alldiv
_allshl
_allshr
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ZwMakeTemporaryObject
ZwCreateDirectoryObject
ObfDereferenceObject
IoDeleteDevice
hal
KeGetCurrentIrql
KeStallExecutionProcessor
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ