Static task
static1
General
-
Target
505033b77398317e586c09c2912d1782
-
Size
27KB
-
MD5
505033b77398317e586c09c2912d1782
-
SHA1
f41570042ea649a5e565bc9c48dca117002af135
-
SHA256
2dc40de613515f6f11dabcd07ecfa1f756864016a8388b25d78f25cccd4b97d8
-
SHA512
1057e90928fd2914981c1175ffb8aa2df55affa303dc109f45f67bf3ded2a7893db882f4978b5c9111b137db2073fded31cdb23da3afedfd7837c4a352503a27
-
SSDEEP
768:cpvm259UhcipkEg5ISkry4p67EXwY7S2JeyEiBYJdXVqBoiGW:g5azQiHivkBoiGW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 505033b77398317e586c09c2912d1782
Files
-
505033b77398317e586c09c2912d1782.sys windows:4 windows x86 arch:x86
f30dc93cb3afe9a28c82aa114bfd767b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
ObfDereferenceObject
ObQueryNameString
ZwMapViewOfSection
ZwClose
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
ExFreePool
ExAllocatePoolWithTag
_snprintf
ZwQuerySystemInformation
wcscpy
wcscat
MmGetSystemRoutineAddress
swprintf
ZwUnmapViewOfSection
KeServiceDescriptorTable
RtlCopyUnicodeString
_wcsnicmp
wcslen
_except_handler3
RtlAnsiStringToUnicodeString
_stricmp
strncpy
IofCompleteRequest
strncmp
IoGetCurrentProcess
RtlCompareUnicodeString
ExGetPreviousMode
_strnicmp
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 756B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ