Static task
static1
General
-
Target
45c0d8787c7f6c3bfa74cd0c4b3b9bb4
-
Size
20KB
-
MD5
45c0d8787c7f6c3bfa74cd0c4b3b9bb4
-
SHA1
325043fb26008f267c41313ee42619c6e3b7662a
-
SHA256
7f50b3154bdf48e575bd2a4717abc6c3250eb81f12685b0e3a5edad30b07503c
-
SHA512
87b3e3d884414dc74808e88b963cf9f77d58235ed4b72947e3a806616a54592d1233c6b1b3e41a177e5386dbadeb0e5ef1c303c9b67b7f9e97abcf5018caaee4
-
SSDEEP
384:YjtI8NSkfSqVp9PsUP/0XK+BN2VLLJBiLm7m5YVTdISP:+NSoP+B8BLJBHRdl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45c0d8787c7f6c3bfa74cd0c4b3b9bb4
Files
-
45c0d8787c7f6c3bfa74cd0c4b3b9bb4.sys windows:4 windows x86 arch:x86
6b43fb6048cc0b5d3016a26beb061fdc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IofCompleteRequest
KeServiceDescriptorTable
ZwWriteFile
ZwTerminateProcess
ZwSetValueKey
ZwReadFile
ZwQueryInformationProcess
ZwQueryInformationFile
ZwQueryDirectoryFile
ZwOpenThread
ZwOpenProcess
ZwDeleteFile
ZwCreateKey
ZwCreateFile
ZwClose
ZwAllocateVirtualMemory
RtlCompareUnicodeString
NtLockFile
_strnicmp
PsLookupProcessByProcessId
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 816B - Virtual size: 806B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 608B - Virtual size: 606B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ