Static task
static1
General
-
Target
264b1509fa078373ef3b3afb22de866f
-
Size
63KB
-
MD5
264b1509fa078373ef3b3afb22de866f
-
SHA1
1a82c7a6af057d143ba7e0afdd8f7e43aa595a2d
-
SHA256
c187bf985c5b38024aba762dab90cd4609116579ac9e68c6b3b70c7da7169cc9
-
SHA512
f9fbd2328434a4912f7056c652a995b1a3b94e028c6638b1c246b06da9cafd5cc05fe99937567ddddb8ed066561e3962cd3668024303f4a6dfcd90e0013c3109
-
SSDEEP
768:9x5p5zvkvvBhvyCOTvjxM7fu0RKAS/zLLaKFT8WZZzixYv5:D5p5zvkXvvyjTvNWRKAS/zLpCxY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 264b1509fa078373ef3b3afb22de866f
Files
-
264b1509fa078373ef3b3afb22de866f.sys windows:4 windows x86 arch:x86
066eb47459f1b1bd28f224b4caec4089
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
NtClose
IoGetDeviceObjectPointer
ExInitializeNPagedLookasideList
ZwSetValueKey
KeSetEvent
MmMapLockedPages
ZwCreateKey
IoFreeIrp
ZwDeleteKey
ObfDereferenceObject
IoFreeMdl
_stricmp
ExAllocatePoolWithTag
KeGetCurrentThread
_wcsicmp
KeInitializeEvent
ZwSetInformationFile
ExInterlockedPushEntrySList
IoAllocateMdl
KefAcquireSpinLockAtDpcLevel
ExInterlockedPopEntrySList
PsCreateSystemThread
memset
MmBuildMdlForNonPagedPool
KeWaitForSingleObject
ZwQueryValueKey
ZwWriteFile
_wcsnicmp
ExFreePoolWithTag
ZwCreateFile
ZwQueryInformationFile
ZwReadFile
ZwClose
KeDelayExecutionThread
KefReleaseSpinLockFromDpcLevel
ZwFlushKey
IoAllocateIrp
RtlUnwind
PsGetVersion
PsLookupThreadByThreadId
PsLookupProcessByProcessId
KeStackAttachProcess
KeInsertQueueApc
KeUnstackDetachProcess
KeInitializeApc
ZwQuerySystemInformation
MmGetPhysicalAddress
MmHighestUserAddress
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisFreePacketPool
NdisFreePacket
NdisOpenAdapter
NdisAllocateMemoryWithTag
NdisAllocatePacket
NdisDeregisterProtocol
NdisRegisterProtocol
NdisFreeMemory
NdisCloseAdapter
NdisAllocatePacketPool
NdisFreeBufferPool
NdisAllocateBuffer
NdisAllocateBufferPool
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ