Static task
static1
General
-
Target
75ee772460475cf16c4cff8ad06e9fff
-
Size
40KB
-
MD5
75ee772460475cf16c4cff8ad06e9fff
-
SHA1
589ace9ca301acb389fa9bd528af95b6b0192078
-
SHA256
e3059a5ce2b435a679d94b3f5c294f7d5d651272557919ce2f15e0ba42e1aba0
-
SHA512
a74e088f347661f7f3dc81f7d115e6342b8f546fe369d80e96d8b6797bfde450ed2ba491863f710ae9fbf4d83e19584ef4c36650e9b34e8862d7b69859ccdac0
-
SSDEEP
768:/VchjplSFOeB7Qam2zJFj/IoDgjtJCK8TnkCFB7pV1IvdS7BgcuENS3b9:/VcHlScMFmwzGjtJCV7bFB1oS7CcuWSB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75ee772460475cf16c4cff8ad06e9fff
Files
-
75ee772460475cf16c4cff8ad06e9fff.sys windows:4 windows x86 arch:x86
5686ac789c0a64544e61ca675a627de1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
swprintf
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
ZwSetValueKey
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
wcslen
wcscat
wcscpy
ObfDereferenceObject
ObReferenceObjectByHandle
wcsrchr
IoDeviceObjectType
ExFreePool
ExAllocatePoolWithTag
ZwCreateKey
_wcsicmp
_except_handler3
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
KeQuerySystemTime
_wcsnicmp
PsCreateSystemThread
wcsstr
_wcslwr
strncmp
IofCompleteRequest
KeDelayExecutionThread
ZwCreateFile
KeTickCount
KeQueryTimeIncrement
_stricmp
strncpy
RtlCompareUnicodeString
_snwprintf
RtlAnsiStringToUnicodeString
_snprintf
wcschr
ZwSetInformationFile
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
ZwDeleteKey
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 78B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ