Static task
static1
General
-
Target
3b99d5e81c4ad1c35629394f85a112b2
-
Size
23KB
-
MD5
3b99d5e81c4ad1c35629394f85a112b2
-
SHA1
b0e2e389aa5e3537185fbb95bc456e0810f009c5
-
SHA256
eafb4bd7dc790df282a92c5965a3c33b884aa7cefadb1b7245ab070fff03c061
-
SHA512
8e6d030482d2404c1a504fff4eb897a2434db9c5cacdce13d0ca233d2e4544c7a10feced2b26ce98e05396a9016eb00e132c4f7cd43464c5b29a4bcf15886500
-
SSDEEP
384:MenIh0vWcYiY7OcA1ON7uyvj5bySN3+VTO3N+xS7nj2NC/KJpq1By3:Men0b3N7OcA1OZ7dbz9+Va3NLj2NCOYw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b99d5e81c4ad1c35629394f85a112b2
Files
-
3b99d5e81c4ad1c35629394f85a112b2.sys windows:4 windows x86 arch:x86
9221afa698fa6111359008ad959d15b4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcscpy
RtlInitUnicodeString
_except_handler3
wcscat
MmGetSystemRoutineAddress
swprintf
_stricmp
strncpy
IofCompleteRequest
IoGetCurrentProcess
ObfDereferenceObject
ObQueryNameString
ZwUnmapViewOfSection
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
strncmp
_wcsnicmp
wcslen
MmIsAddressValid
RtlCopyUnicodeString
KeServiceDescriptorTable
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlCompareUnicodeString
ExGetPreviousMode
_strnicmp
RtlAnsiStringToUnicodeString
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 756B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 928B - Virtual size: 914B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ