Static task
static1
General
-
Target
5b360e84a917e1ac0997995e06dcf8d0
-
Size
27KB
-
MD5
5b360e84a917e1ac0997995e06dcf8d0
-
SHA1
8db80e49262c42a9ba72e7afbcb6d581e9d3ea8d
-
SHA256
678c07241236b6e1c470b67f797dc34242dce0c2b8d113e3bdc4ac644f592a4e
-
SHA512
817cd6a838fd57733f2ab444d3d4d207a31a347adbbb5084b695dceba546973d84dece5e479efc039b9ccfd169cfe1f02ea1298ee05f60ada9801f32098147bc
-
SSDEEP
768:zYdW37bSz/wXEs1ZgdXY2s0Tv8TRdBY7YR4Tn9N:zYdW3/eGE8ipTv8TRdBY7YR4Tn9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b360e84a917e1ac0997995e06dcf8d0
Files
-
5b360e84a917e1ac0997995e06dcf8d0.sys windows:4 windows x86 arch:x86
00d324806a5571b6bdf4dc74e2b90546
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
wcscpy
wcscat
RtlInitUnicodeString
RtlCopyUnicodeString
ZwClose
MmIsAddressValid
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
swprintf
_except_handler3
strncpy
IoGetCurrentProcess
MmGetSystemRoutineAddress
IofCompleteRequest
ExFreePool
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
_snprintf
ZwQuerySystemInformation
strncmp
_stricmp
_wcsnicmp
wcslen
ObfDereferenceObject
ObQueryNameString
_strnicmp
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 700B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ