Static task
static1
General
-
Target
535a7e5279911584d3c9129da1b2fc65
-
Size
3KB
-
MD5
535a7e5279911584d3c9129da1b2fc65
-
SHA1
f4f792beb2290b8ff048b4de364074ef4d7222ad
-
SHA256
a103459f2d27fd65ea14209d92a149bd220ba58adf698dc3cf04cfa38ef1db4d
-
SHA512
fa218845772659afa9b7a17b63213bf9f174272efef1b68f49176fd180c166e816508010b8cdf800d15ca1d613a8f7c99617a049413d4a0b25d032c84fcae5f2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 535a7e5279911584d3c9129da1b2fc65
Files
-
535a7e5279911584d3c9129da1b2fc65.sys windows:5 windows x86 arch:x86
2be5d4c7d34f01780ed31a60890baee6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePoolWithTag
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
PsTerminateSystemThread
ObReferenceObjectByHandle
PsCreateSystemThread
ObfDereferenceObject
PsLookupProcessByProcessId
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeWaitForSingleObject
MmGetSystemRoutineAddress
hal
KfRaiseIrql
KeGetCurrentIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 163B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 566B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.nhts Size: 128B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE