Static task
static1
General
-
Target
483d38ae9b6e96e348841db989c1ea60
-
Size
19KB
-
MD5
483d38ae9b6e96e348841db989c1ea60
-
SHA1
e9563469f8b632442c66e1089195078a58d7c327
-
SHA256
7034096ac119cbd8d1af1a717e46334ab190b9d7daaa7d70ebb959fb512488a5
-
SHA512
785eac72378694ada7bded42bf232ca6fd989e3104b90bf5f3f7a67fb89d8ba5a242954da505c507485fdc317e0fb770f445092da415b4603afe2246cf010e73
-
SSDEEP
384:UwnETQX5uYduL3Teadjh9fcurj8p42hvZuo63gslLg2IF08/uyE:UQETQ8R7TeYjhr1evZt6+rf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 483d38ae9b6e96e348841db989c1ea60
Files
-
483d38ae9b6e96e348841db989c1ea60.sys windows:4 windows x86 arch:x86
158c9ad09d87dca22b561141e84a454c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strchr
atoi
srand
isprint
isspace
isupper
strstr
islower
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
PsGetVersion
isxdigit
strrchr
tolower
atol
ZwClose
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
swprintf
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
isdigit
RtlAnsiStringToUnicodeString
MmIsAddressValid
strncmp
IoGetCurrentProcess
_wcsnicmp
wcslen
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwCreateFile
IoRegisterDriverReinitialization
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
toupper
ZwCreateKey
wcscat
wcscpy
_wcslwr
wcsncpy
ZwUnmapViewOfSection
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 896B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ