Static task
static1
General
-
Target
5afce81406a202ba14cd4aa9fa5affc5
-
Size
40KB
-
MD5
5afce81406a202ba14cd4aa9fa5affc5
-
SHA1
412a8398ef24f75597ca4940d00788356184a324
-
SHA256
20f30dd18601c6a1658bd7a3bea184f9fd45b83df7daa6bacf6e5cc2d0ce9bca
-
SHA512
b2a1b366bf1b215187755586d62d61399a14bbff57b77fa3fca319374e9404415987718dc6728e058f6dbf63a5ea046d279fdb5daf09b62f5310e1f129677bb0
-
SSDEEP
768:/f0NZ3xBstMZE0N42XiV5JrWK+AemYJKx5KcddI60TWvUwvDvfPFskXVZans9dlN:sx7stMZE2lXiVvrL+AtYJKxEc3Ifrirh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5afce81406a202ba14cd4aa9fa5affc5
Files
-
5afce81406a202ba14cd4aa9fa5affc5.sys windows:4 windows x86 arch:x86
aba5141e332526e0242edac1305b2a7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
ZwSetValueKey
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
IofCompleteRequest
ObfDereferenceObject
swprintf
PsSetCreateProcessNotifyRoutine
ExFreePool
ExAllocatePoolWithTag
KeQuerySystemTime
wcslen
_snwprintf
wcsncpy
wcschr
MmIsAddressValid
wcsrchr
MmGetSystemRoutineAddress
wcscat
wcscpy
_wcsicmp
strncpy
IoGetCurrentProcess
KeDelayExecutionThread
_stricmp
wcsstr
_wcslwr
ZwCreateFile
ZwCreateKey
RtlCopyUnicodeString
ZwDeleteKey
RtlAnsiStringToUnicodeString
ZwSetInformationFile
RtlCompareUnicodeString
IoDeviceObjectType
PsGetVersion
IoRegisterDriverReinitialization
strncmp
_snprintf
_wcsnicmp
PsLookupProcessByProcessId
PsCreateSystemThread
KeTickCount
KeQueryTimeIncrement
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 59B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ