Static task
static1
General
-
Target
74b71f61c0d699a49b130f56914eac59
-
Size
40KB
-
MD5
74b71f61c0d699a49b130f56914eac59
-
SHA1
a03da28e28cb8e9a1ab6244a31df0ac1116c51d0
-
SHA256
56c9f03e758bebb624fb2030be3105a95090f41608cae198239ed946ff14fc8e
-
SHA512
6de373dbf9a3344d82080d5f85e5388bd48390f3a6700e7949f21d258d6c23eebac98059f7fb192f026a4b5e3fa00d39e3957739756127dee2461857188437cd
-
SSDEEP
768:gx0W07X3CKo+vj4J+GzEzJT2zSJsk19EwcKbPo8l8eKVJzqubM2+atEvAwmPLQ5g:gxm7X4GbTMTq6MmwAQ58Y2h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74b71f61c0d699a49b130f56914eac59
Files
-
74b71f61c0d699a49b130f56914eac59.sys windows:4 windows x86 arch:x86
34dfd2de217e86f595e10674dc72f0fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
PsSetCreateProcessNotifyRoutine
strncpy
PsLookupProcessByProcessId
_stricmp
IoGetCurrentProcess
MmIsAddressValid
IoDeviceObjectType
ZwClose
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
swprintf
KeDelayExecutionThread
KeQuerySystemTime
RtlAnsiStringToUnicodeString
_wcsicmp
wcsncpy
wcsrchr
IoRegisterDriverReinitialization
_snwprintf
ExAllocatePoolWithTag
ZwSetValueKey
ObReferenceObjectByHandle
ZwDeleteKey
ZwOpenKey
KeTickCount
KeQueryTimeIncrement
strncmp
ObfDereferenceObject
IofCompleteRequest
wcschr
wcsstr
_wcslwr
ZwCreateKey
PsCreateSystemThread
ZwQueryValueKey
_wcsnicmp
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ExFreePool
RtlCompareUnicodeString
RtlCopyUnicodeString
wcscat
_except_handler3
_snprintf
PsGetVersion
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 55B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ