Static task
static1
General
-
Target
4e53d92aab7db3be3d5c0424286121cc
-
Size
28KB
-
MD5
4e53d92aab7db3be3d5c0424286121cc
-
SHA1
d16b4daa2459cc6c1430d95499232f540a0eae24
-
SHA256
46fa2b3e9598eeedd4419a1cb142f6a385e44db2312a707278179efe20ef2392
-
SHA512
542f4e8507e6bdb3d90ef42f83eccc8af7fce7e74d4977af4165f5b6068498c3b306097b8e36ce0ce344526610fe9ce9a590ad888c46cc9a9a7e64f73bb7682f
-
SSDEEP
768:cVqfIdwr+tYXMiVbRUXujd+IDwn+UiYFl3+EM7ZPGsF3K0J4:LMEaRM71rg0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e53d92aab7db3be3d5c0424286121cc
Files
-
4e53d92aab7db3be3d5c0424286121cc.sys windows:4 windows x86 arch:x86
ee858c4f5e65f990ced79771ca45fa24
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_wcsnicmp
wcslen
strncmp
IoGetCurrentProcess
ZwClose
swprintf
wcscpy
RtlInitUnicodeString
_except_handler3
strncpy
ZwUnmapViewOfSection
_strnicmp
RtlCopyUnicodeString
KeServiceDescriptorTable
wcscat
_stricmp
ObfDereferenceObject
ObQueryNameString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ExFreePool
_snprintf
ExAllocatePoolWithTag
ZwQuerySystemInformation
RtlCompareUnicodeString
ExGetPreviousMode
MmIsAddressValid
MmGetSystemRoutineAddress
IofCompleteRequest
RtlAnsiStringToUnicodeString
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 756B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ