Static task
static1
General
-
Target
736139bd4f29e6e2b1161eea1201690e
-
Size
50KB
-
MD5
736139bd4f29e6e2b1161eea1201690e
-
SHA1
a4e5be45776e5936169e0d97e3489ea4685569ca
-
SHA256
d5709033d81be7f8ecf11f3456a47cf9f2fb326c9fe3a7803bae47f083656ffe
-
SHA512
a10f3b45dbd6321f1bf2f54a7b94661b7d6d9bb0194685f402ec5b805dc8e500e368f0629efc4290a3041b0fae9b8bba00430af53141cc997ae089bb26e388a5
-
SSDEEP
768:2Y6jMsfus/qqeMWHbP1YPH9ONfOTCoFXazZd2Ja6b8:MushlWHxQQ94CkGZd2Ja6g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 736139bd4f29e6e2b1161eea1201690e
Files
-
736139bd4f29e6e2b1161eea1201690e.sys windows:4 windows x86 arch:x86
06d93af339d33b29ec89aa7b2f7eb1a9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoGetCurrentProcess
ZwClose
ZwDeleteValueKey
RtlInitUnicodeString
KeDelayExecutionThread
_except_handler3
PsCreateSystemThread
ZwQueryValueKey
ZwOpenKey
ZwCreateFile
IoRegisterDriverReinitialization
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
wcsncmp
wcslen
towlower
MmGetSystemRoutineAddress
RtlCopyUnicodeString
wcsstr
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
ZwSetValueKey
PsGetVersion
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
_strnicmp
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
strncmp
strncpy
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 67B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 992B - Virtual size: 982B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ