Static task
static1
General
-
Target
2c928feddd12812b9bed0c50b859d863
-
Size
49KB
-
MD5
2c928feddd12812b9bed0c50b859d863
-
SHA1
03733f79d3a9f3d1c7434807d25a21217bb35150
-
SHA256
83895e0b597ea878dde043c037160bfa155fdb7d77df4db3a1544581e7df80ec
-
SHA512
feb96ac371aed08b2cdb05128acfa7d036f9e47e2823ddc1821ed2102f420398bcacaee7c16bb323eebcc95a215ff10a1eace1de88e53784aa07f59136244546
-
SSDEEP
768:XrV7TYFvB9CPJIISrSL1RRrvvLSyLcf0Ku:7GvyRrv1s0K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c928feddd12812b9bed0c50b859d863
Files
-
2c928feddd12812b9bed0c50b859d863.sys windows:4 windows x86 arch:x86
5b12c4f159137b743e4cd5ab9219449a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwCreateFile
RtlInitUnicodeString
MmIsAddressValid
PsGetVersion
_wcslwr
wcsncpy
IoRegisterDriverReinitialization
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 900B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 736B - Virtual size: 714B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ