Static task
static1
General
-
Target
3e564bac2c54fba4c1e0e3cd109a2814
-
Size
11KB
-
MD5
3e564bac2c54fba4c1e0e3cd109a2814
-
SHA1
b269d43ebc33bc9eadccf21c786e0683a484c172
-
SHA256
29d6fac46796f0a16223e2a30cfdcc15dd8ca09797ee68d2879b953d527213ad
-
SHA512
6a2dc22bdd4d9bd8897c08b07fb499ad91da9a610fb06ae40045d27043cf8d7bb86146042febce2a5b52df62481894c654f2b7f8ce83e25899fb2d5974846f20
-
SSDEEP
192:bauBsrFEUblJ0Ar3ejfUeIYpF/EdOI6G4COIF9P0XOYlZlgB6XqUGZw:2b7BDYL/EdDfSrPbT4Zw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e564bac2c54fba4c1e0e3cd109a2814
Files
-
3e564bac2c54fba4c1e0e3cd109a2814.sys windows:5 windows x86 arch:x86
cb472ceb22ce4823e8e3c52cf0042aa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
sprintf
_strupr
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwQueryValueKey
ZwEnumerateValueKey
ZwEnumerateKey
ZwOpenKey
ZwDeviceIoControlFile
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
wcscpy
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
_wcsupr
ObReferenceObjectByHandle
ObfDereferenceObject
ObQueryNameString
RtlInitAnsiString
ZwClose
ZwSetValueKey
wcslen
wcsncmp
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ