Static task
static1
General
-
Target
3f91b9c67f8bda6c47fe49b39117966d
-
Size
28KB
-
MD5
3f91b9c67f8bda6c47fe49b39117966d
-
SHA1
c341469007ef4f624aa6eb48a85e3932c1cd013d
-
SHA256
3b41d5492c802e09ba2ca9d1b4757bb6228e2486bec338a6ea6cafdded8b1488
-
SHA512
ca48c9f6b73549e26a926191f6a1318544ed840c8fcd4c6e87596cfa170e591f9323890e44a672a8a2011a1639d00fd5a489a728639d71ce39ede0aee044a4fa
-
SSDEEP
768:4VqfIdwr+tYXMiVbRUXujd+IDwn+UiYFl3+EM7ZPGsF3KrJ4:nMEaRM71rgr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f91b9c67f8bda6c47fe49b39117966d
Files
-
3f91b9c67f8bda6c47fe49b39117966d.sys windows:4 windows x86 arch:x86
ee858c4f5e65f990ced79771ca45fa24
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
strncmp
IoGetCurrentProcess
ZwClose
swprintf
wcscpy
RtlInitUnicodeString
_except_handler3
strncpy
ZwUnmapViewOfSection
_strnicmp
RtlCopyUnicodeString
KeServiceDescriptorTable
wcscat
_stricmp
ObfDereferenceObject
ObQueryNameString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
RtlCompareUnicodeString
ExGetPreviousMode
MmIsAddressValid
MmGetSystemRoutineAddress
IofCompleteRequest
RtlAnsiStringToUnicodeString
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 756B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ