Static task
static1
General
-
Target
4dd888fc6719b908aa3825190b65fb20
-
Size
22KB
-
MD5
4dd888fc6719b908aa3825190b65fb20
-
SHA1
17fb645f42e3d0fc5f5d90b1e2fab12c96bd622f
-
SHA256
e50865fbdcabb8b971cee2d85b59a7f7e060a98ce5550059b788908f873e56ef
-
SHA512
6fee967344925b07e95ddf2a90620559ccc333c7b2a099c9e99b3754c0c329676255a21e345e6197e43cc62a3100119431c2fd4d9c8b817b5b9a77683d86f38d
-
SSDEEP
384:XxpBP4Nyq5M3/jZZhKMwyhUkFiL9D3s08nhhoswMYbpZqKoO4/6RD3Y7WnZlFe08:14McMLbhKMwyaY+9Dc0erapZqKoV/CMc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dd888fc6719b908aa3825190b65fb20
Files
-
4dd888fc6719b908aa3825190b65fb20.sys windows:5 windows x86 arch:x86
b9ca1be45647bca2c084b7e7ae005ef8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
KeInitializeEvent
memcpy
memset
IoDeleteDevice
IoAttachDeviceToDeviceStack
PoSetPowerState
KeInitializeSpinLock
IoCreateDevice
IoDetachDevice
IofCompleteRequest
IofCallDriver
InterlockedExchange
KefAcquireSpinLockAtDpcLevel
IoReleaseCancelSpinLock
KeClearEvent
InterlockedIncrement
InterlockedDecrement
PoCallDriver
PoStartNextPowerIrp
ExFreePool
PoRequestPowerIrp
ExAllocatePoolWithTag
IoQueueWorkItem
IoAllocateWorkItem
IoFreeWorkItem
KeWaitForSingleObject
KeSetEvent
ObfDereferenceObject
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 1014B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ibxn Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ