Static task
static1
General
-
Target
581bfec89a93461da2e3b5bd9890cf30
-
Size
40KB
-
MD5
581bfec89a93461da2e3b5bd9890cf30
-
SHA1
874586bfe7bee5fd46c8c663b4d1d1cd134824ff
-
SHA256
dbbf071ef0e689a9e26bee23b0de334457142f5c224b548af6dffb9950846f8f
-
SHA512
6b3283181ce1001fb0880b55bf7c64bd712d1d9b439aac583d2f2c4b480775548047ceee455781948310971fe86e1bc2604071b38fb4d11e1b5c86ea8bace836
-
SSDEEP
768:gishIQuMGxed0ywroVLyW7hjAbiK/lj3ZWMCPH12qGFoetfeiPz7GrQphqraWzPw:ehOve0ywroVWsW/HCPHibZSzDS8qj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 581bfec89a93461da2e3b5bd9890cf30
Files
-
581bfec89a93461da2e3b5bd9890cf30.sys windows:4 windows x86 arch:x86
b70734c6c62985100a6c38a6570cc7be
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
swprintf
ObReferenceObjectByHandle
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
strncpy
IoGetCurrentProcess
KeQuerySystemTime
strncmp
PsCreateSystemThread
_snwprintf
ExAllocatePoolWithTag
PsSetCreateProcessNotifyRoutine
_wcsnicmp
_wcsicmp
wcsncpy
wcsrchr
MmIsAddressValid
PsGetVersion
IoRegisterDriverReinitialization
ExFreePool
_snprintf
RtlCompareUnicodeString
RtlCopyUnicodeString
ZwCreateKey
wcscat
wcscpy
ZwSetInformationFile
ZwCreateFile
PsLookupProcessByProcessId
_stricmp
ZwDeleteKey
IoDeviceObjectType
MmGetSystemRoutineAddress
ObfDereferenceObject
wcsstr
_wcslwr
wcschr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeQueryTimeIncrement
IofCompleteRequest
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 61B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ