Static task
static1
General
-
Target
5778bac12b02bbaf81a12ad765e3a6f8
-
Size
20KB
-
MD5
5778bac12b02bbaf81a12ad765e3a6f8
-
SHA1
45367d058d36cae4749b92f384c6c6d59fed1bf2
-
SHA256
433e7b7587fff82fefdd62c37d3ef79ead4b126d6ee8ccc9b573d080426c7b60
-
SHA512
7676d1069498479b95d6bb930ad440cf66932d41d0915c1e7d9996db6a4a74a5f057ef74cd60df9d6eb4215da5df747768b52215fc7af7e49fc34132156afcaf
-
SSDEEP
384:6o51Aecjcq8CujeJBAjMHsIpiKnE4T7pYF4u3UVaDwBt3oZSbMtGPSxIOkCWhFYW:6oPZcjcksIpiKE4T7pYF4u3UVaDwBt3O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5778bac12b02bbaf81a12ad765e3a6f8
Files
-
5778bac12b02bbaf81a12ad765e3a6f8.sys windows:4 windows x86 arch:x86
bd3a1f9d99b93e9d5635d484ac5ed479
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetValueKey
strstr
ZwQueryValueKey
ZwClose
ExFreePool
ZwCreateKey
RtlInitUnicodeString
wcscat
wcscpy
ExAllocatePoolWithTag
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
PsGetVersion
_stricmp
_wcsnicmp
wcslen
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
strncmp
IoGetCurrentProcess
_except_handler3
_snwprintf
ZwEnumerateKey
ZwOpenKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwCreateFile
IofCompleteRequest
MmGetSystemRoutineAddress
ZwWriteFile
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 864B - Virtual size: 864B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ