Static task
static1
General
-
Target
4190b1ef3840c00c2b68b0db2257f1ae
-
Size
16KB
-
MD5
4190b1ef3840c00c2b68b0db2257f1ae
-
SHA1
b3c8df3dc078ed2761d1e6dfe2b65b2534ca099d
-
SHA256
43ca63810498568da77dd47030aeca1b9ebc5aa47c2edf4dd839207d03832bf0
-
SHA512
489249b7f0cd2e2d77edbfd7481a2d5ac26773da3a3d788f3d37c3ba0093441666b4e8c4dc31980b2f345a2d686c263b8239188c32d60d658836fc99b5060107
-
SSDEEP
384:EnHH1COEaSix0gUAEan7aXCocu5AXE/xWJ+SGOcg3rprg/FdA9sl7fTz5+26HOEO:M8OEf+puEDi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4190b1ef3840c00c2b68b0db2257f1ae
Files
-
4190b1ef3840c00c2b68b0db2257f1ae.sys windows:5 windows x86 arch:x86
b3d7176032cc7d764c4ef684bcc16d69
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeUnstackDetachProcess
ZwTerminateProcess
KeStackAttachProcess
PsLookupProcessByProcessId
ExGetPreviousMode
MmIsAddressValid
ProbeForWrite
ProbeForRead
_except_handler3
strncmp
IoGetCurrentProcess
IofCompleteRequest
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ExAllocatePoolWithTag
MmSizeOfMdl
ZwQueryInformationProcess
PsGetCurrentProcessId
_stricmp
_strupr
RtlFreeAnsiString
_strlwr
strrchr
RtlUnicodeStringToAnsiString
ExFreePool
ZwPulseEvent
MmGetSystemRoutineAddress
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwQuerySystemInformation
IoDeleteDevice
IoDeleteSymbolicLink
PsTerminateSystemThread
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zdata Size: 288B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vdata Size: 288B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 912B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 358B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ