Static task
static1
General
-
Target
e806c60999997757c1e2d62fc7d9683df03b2cb08da407d0466d9feb4eb5e457.exe
-
Size
405KB
-
MD5
b4ee5a7a67fc34e14ab2aa47a7178d5e
-
SHA1
2a2e32ba999fb81cee5f638c0723d18103f1b7aa
-
SHA256
e806c60999997757c1e2d62fc7d9683df03b2cb08da407d0466d9feb4eb5e457
-
SHA512
ead93250eea0705d46fbe48ab8c4fbf34c748b1a374c5c120b4d50f90d62fe73bc5ff75c1bda653f4aebc4410140d508f4e04c1ade034b1710c4d16effa1ce60
-
SSDEEP
3072:ogXkA1CudLrFYhNS9rTMLwK3zrn/MCF8tH5cMulSb+arQZC:pXkIvXhK3z1BSCUQZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e806c60999997757c1e2d62fc7d9683df03b2cb08da407d0466d9feb4eb5e457.exe
Files
-
e806c60999997757c1e2d62fc7d9683df03b2cb08da407d0466d9feb4eb5e457.exe.sys windows:6 windows x86 arch:x86
625e3aa964224570bf9e68e5b07a0382
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
ZwMapViewOfSection
ZwCreateSection
ZwOpenKey
ObfDereferenceObject
KeWaitForSingleObject
KeGetCurrentThread
ZwSetValueKey
RtlInitUnicodeString
ZwQueryValueKey
KeQuerySystemTime
PsTerminateSystemThread
ObReferenceObjectByHandle
PsCreateSystemThread
ZwDeleteValueKey
_allmul
_alldiv
ZwOpenFile
KeQueryTimeIncrement
KeWaitForMultipleObjects
KeTickCount
_stricmp
MmGetSystemRoutineAddress
RtlCompareUnicodeString
KeUnstackDetachProcess
ZwAllocateVirtualMemory
KeStackAttachProcess
ZwFreeVirtualMemory
ZwDuplicateObject
ObOpenObjectByPointer
PsProcessType
PsLookupProcessByProcessId
ZwReadFile
wcsrchr
ZwSetInformationFile
ZwQueryDirectoryFile
_wcsicmp
swprintf
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
IoAllocateMdl
_aulldiv
wcschr
wcsspn
wcsncpy
PsGetVersion
ObfReferenceObject
IoSetThreadHardErrorMode
RtlFreeUnicodeString
ZwLoadDriver
ZwCreateEvent
RtlQueryRegistryValues
ZwEnumerateKey
ZwDeleteKey
IoCreateFile
ZwFsControlFile
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
_aulldvrm
IofCallDriver
IoFreeIrp
IoAllocateIrp
IoGetRelatedDeviceObject
RtlTimeToTimeFields
KeBugCheckEx
RtlUnwind
ZwUnmapViewOfSection
ExfInterlockedPushEntryList
ZwQuerySystemInformation
ZwTerminateProcess
ZwQueryInformationProcess
ZwClose
ZwOpenProcess
memset
ExAllocatePoolWithTag
KeInitializeEvent
KeClearEvent
KeSetEvent
memcpy
memmove
ExFreePoolWithTag
ExSystemTimeToLocalTime
RtlCompareMemory
InterlockedPopEntrySList
InterlockedPushEntrySList
KeInitializeSemaphore
KeReleaseSemaphore
ExInitializeNPagedLookasideList
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
ExDeleteNPagedLookasideList
DbgPrint
RtlAnsiCharToUnicodeChar
hal
KfReleaseSpinLock
KeQueryPerformanceCounter
KfAcquireSpinLock
ndis.sys
NdisDeregisterProtocol
NdisRegisterProtocol
NdisAllocateMemoryWithTag
NdisFreeBufferPool
NdisFreeMemory
NdisFreePacket
NdisAllocateBuffer
NdisAllocatePacket
NdisFreePacketPool
NdisAllocatePacketPool
NdisUnchainBufferAtFront
NdisAllocateBufferPool
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ