Static task
static1
General
-
Target
5350e6a15e864b566716acf538c5e1a3
-
Size
8KB
-
MD5
5350e6a15e864b566716acf538c5e1a3
-
SHA1
72f474d0cf6298a671b2c8a4d8fa18bace788278
-
SHA256
f277876317b488f3d3c16f887e8bc9a0108fa62cb20e1d448206dd49c97a5f4d
-
SHA512
bdf70a558ec0e716a20b208d8e230381a68a25016a30b61c8150325c7b6c02d65492f72ae5d710b353b643fbea9656f238840028fd1128597bb5c9afb51357a7
-
SSDEEP
192:ZLUTuxO/TSFslR2vC+RezC9P9HNlX5X82WSz8vx:oug/TSFUI3//nW2WSoZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5350e6a15e864b566716acf538c5e1a3
Files
-
5350e6a15e864b566716acf538c5e1a3.sys windows:5 windows x86 arch:x86
9ab02f2bb89a486397708e1687853fb6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoRegisterDeviceInterface
RtlInitUnicodeString
KeInitializeEvent
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeSetEvent
IoSetDeviceInterfaceState
ExFreePoolWithTag
RtlCompareMemory
memmove
ExAllocatePoolWithTag
IoCreateSymbolicLink
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitString
sprintf
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
PoCallDriver
PoStartNextPowerIrp
IoSetHardErrorOrVerifyDevice
IoDetachDevice
IoDeleteSymbolicLink
KeTickCount
KeBugCheckEx
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 842B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ