Static task
static1
General
-
Target
4675d94f018581c37eb791e790eff48c
-
Size
30KB
-
MD5
4675d94f018581c37eb791e790eff48c
-
SHA1
43ac53186bab311b48ad37630ee9547afab86f6a
-
SHA256
71f2823fc4bccd515814d9403550ffc17f45ea2c0b9875536c9fe26933a421bb
-
SHA512
9d9cd8130f435ae7ee3f642e152daede52ebdc83817934ab37a89af8c153a068a7a6b65f99480094300eabd650c583dcdc40ef82353312f49310fc6183713126
-
SSDEEP
768:Up70DJXq5vdr2LXPjyfSoqau6yDw3eE6g/YRgK9Ttvc5OvWNDhrlsCfpL3:HDJXq5vdqbKqa4k3j6g/YeK9TtckmhFN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4675d94f018581c37eb791e790eff48c
Files
-
4675d94f018581c37eb791e790eff48c.sys windows:4 windows x86 arch:x86
aab09ec5cfe1b89dda3446bac03fd939
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strstr
islower
atoi
isprint
isxdigit
isdigit
strrchr
isspace
isupper
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
atol
PsGetVersion
toupper
strchr
ZwCreateFile
ZwSetValueKey
ZwClose
ZwOpenKey
ZwEnumerateKey
KeDelayExecutionThread
ZwCreateKey
wcslen
swprintf
wcscat
wcscpy
tolower
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
RtlAnsiStringToUnicodeString
MmIsAddressValid
IoRegisterDriverReinitialization
srand
_wcslwr
wcsncpy
ZwUnmapViewOfSection
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
strncmp
IoGetCurrentProcess
_wcsnicmp
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ