Static task
static1
General
-
Target
768106e5f25f36f64e3ef5dcfec4b187
-
Size
28KB
-
MD5
768106e5f25f36f64e3ef5dcfec4b187
-
SHA1
ab3648f2d666d86cc3fda61fa168338c69ef655f
-
SHA256
a26d4c0a2dc65087963767ab4b8f6b60f079497257b4c08aede2e863a941961b
-
SHA512
cd7481848a23fc0fbfbf54c20c849cc14c01353cb7b85f99359f50209c2f4a814a1ce94c72aa735632e0ea15332f55113c235d5b4c3a4db132072539402ae091
-
SSDEEP
384:Q7sWwENdE8J5y0q1LVRA+SPJXZafnNbZjdAuQQXMh8diDyRvGvOFgXPWSGRgy1Jw:QdNPXqL3qunN3ASevOPbJRVBXj0q8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 768106e5f25f36f64e3ef5dcfec4b187
Files
-
768106e5f25f36f64e3ef5dcfec4b187.sys windows:5 windows x86 arch:x86
dbdb0548f2bcc25ae023694d9e256237
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
IoGetCurrentProcess
ZwClose
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
ZwOpenKey
RtlInitUnicodeString
KeDelayExecutionThread
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
PsGetVersion
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
ZwQueryValueKey
_except_handler3
strncmp
strncpy
_strnicmp
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
wcsncmp
towlower
ZwDeleteValueKey
wcsstr
IoRegisterDriverReinitialization
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 800B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ