Static task
static1
General
-
Target
3672f2e9c254a3d4f6ea0ef4370d9866
-
Size
17KB
-
MD5
3672f2e9c254a3d4f6ea0ef4370d9866
-
SHA1
50d6005d02bf71245a8a93110b84e502d6aab861
-
SHA256
ecbebbd38e98aad6313552ce812a9b31fac2ca966e287d2848725ef217b4316f
-
SHA512
d019f72c9227c6be32c582ce7152486b9098510db754d478ecd0df9d737ed63f13ad7a7c4e2c24c8b6fafb0f070053aa7002878daefc4379cee7af8154b43804
-
SSDEEP
192:w6pr6oLMMWOu70er3djwUe4gjBHFPcdYCe5doF6bYvtRyB28ox/+a6sz5QXOdrhg:Ky27xHgjBlPcdYCe5d2CYa08g+aISM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3672f2e9c254a3d4f6ea0ef4370d9866
Files
-
3672f2e9c254a3d4f6ea0ef4370d9866.sys windows:5 windows x86 arch:x86
b520a874311b6171b6feabf12a8c0afe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcsncmp
wcslen
ExFreePoolWithTag
ZwEnumerateKey
ExAllocatePoolWithTag
sprintf
_strupr
wcscpy
wcscmp
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwOpenKey
ZwDeviceIoControlFile
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_wcsupr
ZwClose
ZwSetValueKey
swprintf
RtlInitAnsiString
ObfDereferenceObject
ObReferenceObjectByHandle
strchr
ObQueryNameString
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 896B - Virtual size: 780B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ