Static task
static1
General
-
Target
4def8af494ecbbda0d3591563ac73c92
-
Size
49KB
-
MD5
4def8af494ecbbda0d3591563ac73c92
-
SHA1
5e5e93b3765b39d3157817ea21ea82547e1e9086
-
SHA256
07105b407db496251fe8f576ba3b212bb6ca82f221e84ed24bf78e0890931460
-
SHA512
187f58b8bb7ecbe0b4d426c8b8e0d947e33ed83ba1e9d3c3eee3223d7a0b19f038fe2b196349a194ea16f2d335841e0171d62a3a229d7ae4b9cd33ba84ef0255
-
SSDEEP
1536:9I3M6TLFi/80XxOzJ2U+SiFlT6u8Vs3k7KsMINCfAti3SQ5hMRgbzlfPuqt/:9XAxiUgxOzR+X6gk7KsMIYfAAiQ5FbR3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4def8af494ecbbda0d3591563ac73c92
Files
-
4def8af494ecbbda0d3591563ac73c92.sys windows:4 windows x86 arch:x86
4dc1928d461f9f61c48695db0846e538
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsGetVersion
_wcslwr
wcsncpy
RtlInitUnicodeString
ZwClose
PsTerminateSystemThread
KeDelayExecutionThread
PsCreateSystemThread
wcscat
wcscpy
_stricmp
strncpy
PsLookupProcessByProcessId
ExAllocatePoolWithTag
KeInitializeTimer
IofCompleteRequest
ZwCreateFile
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
MmIsAddressValid
PsSetCreateProcessNotifyRoutine
_snprintf
ExFreePool
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
RtlAnsiStringToUnicodeString
swprintf
ZwCreateKey
wcslen
strncmp
IoGetCurrentProcess
_wcsnicmp
ZwUnmapViewOfSection
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 928B - Virtual size: 900B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 736B - Virtual size: 714B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ