Static task
static1
General
-
Target
477b51a7e96c9598090daf85411799aa
-
Size
14KB
-
MD5
477b51a7e96c9598090daf85411799aa
-
SHA1
db08b40c34ff2e75729939add26fe0617d8fb4fa
-
SHA256
83b92b50ddec9743eeb2e95cd0a4e89b114f756fe23b589ae63238938567685e
-
SHA512
4469858b3ba5481b6e92cf0e21459f5576effd3d8aefeb896825266fc70de715e7eaf4c2a8242c181d58a17f9be9ef1ad757a27d2f5f98d12964c484496fe68e
-
SSDEEP
384:jR2WFvZ+T/PPvNGrLA+u09Wb9OeCQ28xw4bg:jRBFv0zlEA+H4hCQhwv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 477b51a7e96c9598090daf85411799aa
Files
-
477b51a7e96c9598090daf85411799aa.sys windows:4 windows x86 arch:x86
aed4136e207db2e1bf2beab9e23e0b09
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
isupper
toupper
tolower
isprint
strchr
isdigit
isxdigit
atoi
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
ZwClose
ZwCreateKey
swprintf
strstr
RtlInitUnicodeString
wcscat
wcscpy
MmIsAddressValid
strrchr
ZwCreateFile
IoRegisterDriverReinitialization
_wcslwr
wcsncpy
PsGetVersion
islower
ZwUnmapViewOfSection
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
srand
isspace
atol
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 832B - Virtual size: 810B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ