Static task
static1
General
-
Target
43ac80bae825eebf1596fcb0d015b5d6
-
Size
2KB
-
MD5
43ac80bae825eebf1596fcb0d015b5d6
-
SHA1
d30a303e6ccbd5553d4ff78753c6aca75270cbd7
-
SHA256
82bde3b5845c4c178976703501c353285bb3459259d48f8717923ea27d14053c
-
SHA512
8e94fe5d93ae64a3324de20f4eb2812729ac24fa8a429d70acad7dfb0b166c81e6e015cf1c467799298e34e945779451a8670958a5829b027b88342ee21f10ff
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43ac80bae825eebf1596fcb0d015b5d6
Files
-
43ac80bae825eebf1596fcb0d015b5d6.sys windows:4 windows x86 arch:x86
eb4f60bac07234e2083ddab15ee76866
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePool
_stricmp
RtlInitAnsiString
RtlAnsiStringToUnicodeString
ZwReadFile
ExAllocatePoolWithTag
ZwClose
ZwQueryInformationFile
ZwCreateFile
ExFreePool
ExFreePoolWithTag
memcpy
strcat
RtlFreeUnicodeString
ZwQuerySystemInformation
KeServiceDescriptorTable
strcpy
InterlockedExchange
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 480B - Virtual size: 468B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 96B - Virtual size: 70B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ