Static task
static1
General
-
Target
25f2d5aa994496c01581c861f0b6aaa0
-
Size
53KB
-
MD5
25f2d5aa994496c01581c861f0b6aaa0
-
SHA1
edc0772a4301a3b2584d3dadf0033731ef519f61
-
SHA256
ba2d465cbbc6a87926489cfa780233b8c696683d09d8b05c11f33c059692ef4a
-
SHA512
78233a4b2f6e794d2a7167f7c21e8dff62f3cfc9850ef315955a45404100def88a53551ce37a0aa3c5d864456373835c7da40b8f928846b8f2f5aab3c6510d5d
-
SSDEEP
768:IuHm+HyrqSIGTPXqTldEqHW771ItBmVwN4pyrxrUyRBR7SN9zk68NcbsClR4a:rHm+oG/WkNR3X9Sbz3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25f2d5aa994496c01581c861f0b6aaa0
Files
-
25f2d5aa994496c01581c861f0b6aaa0.sys windows:4 windows x86 arch:x86
01e493c9d71dfadf54bebc2b2fac0916
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwCreateFile
RtlInitUnicodeString
IoRegisterDriverReinitialization
wcsncmp
wcslen
towlower
MmGetSystemRoutineAddress
wcscat
wcscpy
PsCreateSystemThread
_strnicmp
ExFreePool
ZwEnumerateKey
ExAllocatePoolWithTag
ZwOpenKey
KeDelayExecutionThread
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
IofCompleteRequest
IoGetCurrentProcess
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwDeleteValueKey
_except_handler3
ZwQueryValueKey
strncmp
PsGetVersion
strncpy
wcsstr
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 256B - Virtual size: 242B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 960B - Virtual size: 954B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 1014B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ