Static task
static1
General
-
Target
5412707cc491fdd9bde0497fee3d9581
-
Size
29KB
-
MD5
5412707cc491fdd9bde0497fee3d9581
-
SHA1
33962432e51f51fa565cc9f5e0e86a6508247dfe
-
SHA256
f0101a747f28132d6f70aba10b1e9774cc6b72117592139cf714c3e9576506c1
-
SHA512
e2e18332ac8175dd85dda60f59e39d59fd4a14e831c7bef812644b563e842c888eae7a46cdd0b0492a43cc86038f8530c24d1f9cf18bf3d9f13dc1cf5dac75e7
-
SSDEEP
384:bQdvwT2AefDydSqOafSi20ybbtU7ACf5Z6Pk1t1d7/U:brybsSkfSi7ysAMZ6Ot1dzU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5412707cc491fdd9bde0497fee3d9581
Files
-
5412707cc491fdd9bde0497fee3d9581.sys windows:6 windows x86 arch:x86
4a419c7c41a6941f6fb5d9abc4de2a5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_strlwr
strncpy
ObReferenceObjectByHandle
IoGetCurrentProcess
memset
PsLookupProcessByProcessId
wcsncpy
_wcsicmp
memcpy
IoFreeMdl
MmUnmapLockedPages
ZwQueryDirectoryFile
ZwOpenProcess
ZwTerminateProcess
PsGetVersion
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
ExFreePoolWithTag
ObQueryNameString
ExAllocatePool
KeDelayExecutionThread
ZwClose
ExGetPreviousMode
_stricmp
ZwCreateFile
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwReadFile
ProbeForRead
ZwQuerySystemInformation
ZwCreateKey
swprintf
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwDeleteKey
ZwOpenKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryKey
wcsstr
_wcslwr
ZwEnumerateKey
CmRegisterCallback
CmUnRegisterCallback
KeQuerySystemTime
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ZwWriteFile
ObfDereferenceObject
RtlUnwind
hal
KeGetCurrentIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ