Static task
static1
General
-
Target
2d2ba79c1ad34b24aaca174a7f0dfc97
-
Size
40KB
-
MD5
2d2ba79c1ad34b24aaca174a7f0dfc97
-
SHA1
90e76e8142c329ecfa633529c5c288394d91dcd8
-
SHA256
e650628ac6e59bf9e2e90f76e4c9fbb838a63c93945b0e32405252c48d827a25
-
SHA512
80d822a18fc19d1ac96ce1b3f3e3d45fb6d14644e8a04137890cec34e2ee3fda81a179dab8a211fc615d058b2febd1a210dc9eb2d05e06b05022ca2c2f8a0d86
-
SSDEEP
768:Af0NZ3xBstMZE0N42XiV5JrWK+AemYJKx5KcddI60TWvUwvDvfPFskLXVZans9dn:/x7stMZE2lXiVvrL+AtYJKxEc3IfrirH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d2ba79c1ad34b24aaca174a7f0dfc97
Files
-
2d2ba79c1ad34b24aaca174a7f0dfc97.sys windows:4 windows x86 arch:x86
aba5141e332526e0242edac1305b2a7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
IofCompleteRequest
ObfDereferenceObject
swprintf
PsSetCreateProcessNotifyRoutine
ExFreePool
ExAllocatePoolWithTag
KeQuerySystemTime
wcslen
_snwprintf
wcsncpy
wcschr
MmIsAddressValid
wcsrchr
MmGetSystemRoutineAddress
wcscat
wcscpy
_wcsicmp
strncpy
IoGetCurrentProcess
KeDelayExecutionThread
_stricmp
wcsstr
_wcslwr
ZwCreateFile
ZwCreateKey
RtlCopyUnicodeString
ZwDeleteKey
RtlAnsiStringToUnicodeString
ZwSetInformationFile
RtlCompareUnicodeString
IoDeviceObjectType
PsGetVersion
IoRegisterDriverReinitialization
strncmp
_snprintf
_wcsnicmp
PsLookupProcessByProcessId
PsCreateSystemThread
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ