Static task
static1
General
-
Target
58b919d069b04e550a34cbf09dfee383
-
Size
159KB
-
MD5
58b919d069b04e550a34cbf09dfee383
-
SHA1
2c163ce8d57e7376fcfc72661df20bdcd8ae0118
-
SHA256
ea9d0be82c9d5ba45838a3f72e2ab9c02254eba2e92d51eeb37b5305f3e59e7a
-
SHA512
36afdc31c5747b538e6fda6432a77e3486562c28ef33d999048dca91aa1082afcff0652390bbc11d9cda57184798a43087b0c888192accf24ffadc6a6f70008f
-
SSDEEP
3072:3dCV2PxGjwcNg4T6WFY69NrdlQzXVPkD6c2FfL26HQnZ3gXk23s5Pa+jB3jEx:QVysjLnswL2FfL3yJaU3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 58b919d069b04e550a34cbf09dfee383
Files
-
58b919d069b04e550a34cbf09dfee383.sys windows:5 windows x86 arch:x86
e037ca3d56e3fa625baccb53e84e8148
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_alldiv
SeDeassignSecurity
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
DbgPrint
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlOemStringToUnicodeString
RtlInitString
MmMapLockedPagesSpecifyCache
RtlAppendStringToString
RtlInitAnsiString
strchr
strncpy
KeCancelTimer
ZwClose
ZwCancelTimer
ZwSetTimer
ZwCreateTimer
_aulldiv
_allmul
IofCompleteRequest
IofCallDriver
IoBuildDeviceIoControlRequest
ObfReferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
KeSetTimer
KeInitializeDpc
KeInitializeTimer
IoDeleteDevice
KeClearEvent
ExDeleteResourceLite
IoFreeIrp
IoGetRelatedDeviceObject
ProbeForWrite
_except_handler3
RtlCopyUnicodeString
DbgBreakPoint
ZwCreateKey
memchr
ZwReadFile
ZwQueryInformationFile
RtlFreeUnicodeString
ZwCreateFile
IoRemoveShareAccess
SeAssignSecurity
RtlExtendedLargeIntegerDivide
IoCheckShareAccess
SeAccessCheck
ObReferenceObjectByHandle
NtWaitForSingleObject
ZwDeviceIoControlFile
ZwCreateEvent
wcslen
ExfInterlockedPushEntryList
ExRaiseAccessViolation
MmUserProbeAddress
IoFileObjectType
PsGetCurrentThread
ExQueueWorkItem
KeInsertQueueDpc
IoAllocateIrp
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
RtlExtendedMagicDivide
MmBuildMdlForNonPagedPool
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
swprintf
sprintf
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlMapGenericMask
IoGetFileObjectGenericMapping
SeSetSecurityDescriptorInfo
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
IoCreateDevice
RtlAppendUnicodeToString
ZwOpenKey
ZwQueryValueKey
memmove
IoBuildPartialMdl
MmUnmapLockedPages
KeDelayExecutionThread
MmLockPagableDataSection
KeTickCount
KeBugCheckEx
IoCancelIrp
IoAllocateMdl
ExfInterlockedInsertHeadList
PsGetCurrentProcess
KeAttachProcess
KeDetachProcess
ExfInterlockedInsertTailList
ObfDereferenceObject
IoFreeMdl
KeWaitForSingleObject
KeResetEvent
KeSetEvent
KeInitializeSpinLock
ExSystemTimeToLocalTime
KeInitializeEvent
ExInitializeResourceLite
strrchr
RtlCompareMemory
KeQuerySystemTime
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
strncmp
ExAllocatePoolWithTag
IoSetShareAccess
ExFreePoolWithTag
hal
KfReleaseSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
tdi.sys
TdiRegisterNetAddress
TdiProviderReady
TdiInitialize
TdiRegisterProvider
TdiRegisterPnPHandlers
TdiMapUserRequest
TdiDeregisterPnPHandlers
TdiDeregisterProvider
TdiRegisterDeviceObject
TdiDefaultDisconnectHandler
TdiDefaultErrorHandler
TdiDefaultReceiveHandler
TdiDefaultRcvExpeditedHandler
TdiDefaultSendPossibleHandler
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
TdiDefaultRcvDatagramHandler
TdiBuildNetbiosAddress
TdiDeregisterDeviceObject
TdiDeregisterNetAddress
TdiPnPPowerComplete
TdiEnumerateAddresses
TdiDefaultConnectHandler
TdiPnPPowerRequest
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 896B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGENBT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ