Static task
static1
General
-
Target
38ca018ce87109ee7322455b1003175f
-
Size
49KB
-
MD5
38ca018ce87109ee7322455b1003175f
-
SHA1
12369a0b2aae85ffc05e0b6b3ddd33f1e900d8cd
-
SHA256
312f3da3ea3107737d4b468efdb9b46fdf96e4a50436233360f5a9b3f14809a3
-
SHA512
6ad2074422b8043cd4ca399beaf3f24e6f016dd5b82d318dc8406124a4bcfe5a3e5126ecf2a320eb0e927f54a091f9c6064dcb00a7597ac774d83c1729caabea
-
SSDEEP
768:ErV7TYFvB9CPJIISrSL1RRrvvLSyLcVu:GGvyRrv1O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38ca018ce87109ee7322455b1003175f
Files
-
38ca018ce87109ee7322455b1003175f.sys windows:4 windows x86 arch:x86
5b12c4f159137b743e4cd5ab9219449a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwCreateFile
RtlInitUnicodeString
MmIsAddressValid
PsGetVersion
_wcslwr
wcsncpy
IoRegisterDriverReinitialization
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
PsSetCreateProcessNotifyRoutine
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
ZwUnmapViewOfSection
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 900B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 736B - Virtual size: 714B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ