Static task
static1
General
-
Target
4a8f47c9e138cf07276562e9388da6cc
-
Size
7KB
-
MD5
4a8f47c9e138cf07276562e9388da6cc
-
SHA1
470e040f707d8b2f647fb079d56f8ffcf7a4d577
-
SHA256
b5419f2177265605a2381246acfa0311270c13fbbb8da4d01d19aa4c562ff437
-
SHA512
93d67f02554f0e4b2c57dc2ba44b7ad4588a5d0e9669e163b86865292ceb0dcf39e55f69475fa0314f0cc0c09e946262d92edce2c06ace02daf9e5787c6df154
-
SSDEEP
96:vn9/kz/t1LPjhndxpGTIv711fsEb+S1KzbdFc:F4/btdxpGTIv7YO+1zxq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a8f47c9e138cf07276562e9388da6cc
Files
-
4a8f47c9e138cf07276562e9388da6cc.sys windows:5 windows x86 arch:x86
b4485ee23c49689d473f91c0da747533
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ProbeForRead
ObfDereferenceObject
wcslen
ObQueryNameString
ObReferenceObjectByHandle
KeReleaseMutex
KeWaitForSingleObject
ExFreePoolWithTag
wcsncpy
ExAllocatePoolWithTag
PsLookupProcessByProcessId
ZwClose
ObOpenObjectByName
RtlInitUnicodeString
ObReferenceObjectByName
IoDriverObjectType
wcscat
wcscpy
wcsncat
KeServiceDescriptorTable
NtBuildNumber
IofCompleteRequest
KeInitializeMutex
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
swprintf
_except_handler3
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 706B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ