Static task
static1
General
-
Target
3bb7c57cd9b8e656cde062f4120f231f
-
Size
50KB
-
MD5
3bb7c57cd9b8e656cde062f4120f231f
-
SHA1
056f455d474cf51e3f675312559ba36a7c2610b9
-
SHA256
711253ed2342fc8c2b36e4d7cebd9424f7058100788b37b1f90a8a0da168ed89
-
SHA512
bab4238c3cae6b02a74baeea65a78a11339979690234e529e5654e2c983ac7ed00c4a55586c22b024bfe1aabf334db401f8bc188a7ea9d2602fedcb905dc202e
-
SSDEEP
1536:4Hv4eQnsMs63wrEBmjzBFdGnFAZMskcz6aKsFxiochPSAkTy2:4Hv4eQnsMs63wrEgjzBLGnFAZMskcOap
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bb7c57cd9b8e656cde062f4120f231f
Files
-
3bb7c57cd9b8e656cde062f4120f231f.sys windows:4 windows x86 arch:x86
9b072177b20f5165b502fff4abff73fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
ZwClose
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
MmIsAddressValid
ZwUnmapViewOfSection
_stricmp
strncpy
KeInitializeTimer
IofCompleteRequest
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsGetVersion
_wcslwr
wcsncpy
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 256B - Virtual size: 245B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 704B - Virtual size: 700B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 928B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 768B - Virtual size: 754B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ