Static task
static1
General
-
Target
752298da2a4141f387a0cdeb66d493c2
-
Size
16KB
-
MD5
752298da2a4141f387a0cdeb66d493c2
-
SHA1
659a0bedcbcc276657245b8b87a5568f8ad625f9
-
SHA256
23c1a98c50159ce4b70ce016f9bdcf8b0f197aa573bbcb20289787396e140cb9
-
SHA512
561b1816bc467fd6b6828ab1346ff5eca541606bbb19fd3f1bfda2adbc00672c53fd1de740d7d09abb2bc9bb73f0520bbb372576ce29e5182fd1f005d2f204fe
-
SSDEEP
192:f3olEKWWTpiFop00NbaEpW/wmJPJXJhJRJJJJJJJJJJJJJJJZJRJJJJJJJJJJJJ8:rYaWVaEpW4T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 752298da2a4141f387a0cdeb66d493c2
Files
-
752298da2a4141f387a0cdeb66d493c2.sys windows:5 windows x86 arch:x86
8659e2ae29aa6632ff3e70530ddbc625
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeEvent
IoCreateDevice
InterlockedDecrement
IofCompleteRequest
ExFreePool
KeSetEvent
KeWaitForSingleObject
IofCallDriver
InterlockedIncrement
IoIsWdmVersionAvailable
RtlCopyUnicodeString
ExAllocatePoolWithTag
ZwClose
ZwSetValueKey
wcslen
ZwCreateKey
DbgPrint
RtlAppendUnicodeToString
RtlInitUnicodeString
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
IoAttachDeviceToDeviceStack
MmUnmapViewOfSection
PsLookupProcessByProcessId
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
RtlFreeUnicodeString
IoSetDeviceInterfaceState
PoCallDriver
PoStartNextPowerIrp
InterlockedExchange
KeClearEvent
KeInitializeSpinLock
_except_handler3
IoRegisterDeviceInterface
IoDetachDevice
ObfDereferenceObject
IoDeleteDevice
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 542B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ