Static task
static1
General
-
Target
7922752a0aa863636b12d7cb779893a6
-
Size
40KB
-
MD5
7922752a0aa863636b12d7cb779893a6
-
SHA1
67c36617e0f8942ca519a6d0530ed5ec93f26e2e
-
SHA256
0ac8fdf9f246a7fb8f440c479f7d69a5a54cb53bd6ccc9f00a4e99ad5dbd0be1
-
SHA512
225d765b36d8cf857735afd019f4f3cf46c949d721b0b0a9a51fb89bb53ed4cf0d2362115444fece38befc61a2d52a4a99d0df7e278db75670bbd970a840e52a
-
SSDEEP
768:kkIaOJ3NJEw02rTT/073jKTqvCJWddH0I3LOi1L4hfUBvJ7fSaIs8JGsuJ68/jyR:kk03NJEwrk73jSYdH0I3LpHBvdz8BuH9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7922752a0aa863636b12d7cb779893a6
Files
-
7922752a0aa863636b12d7cb779893a6.sys windows:4 windows x86 arch:x86
b9110451b16df210edfabea09cd21698
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCopyUnicodeString
MmIsAddressValid
RtlCompareUnicodeString
RtlInitUnicodeString
swprintf
ZwClose
PsGetVersion
ObfDereferenceObject
ZwSetValueKey
ZwCreateKey
wcslen
wcsncpy
wcsrchr
IoRegisterDriverReinitialization
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwOpenKey
ZwDeleteKey
strncmp
IoGetCurrentProcess
_wcsicmp
ZwQueryValueKey
ExFreePool
_snprintf
ExAllocatePoolWithTag
PsCreateSystemThread
ObReferenceObjectByHandle
_except_handler3
_snwprintf
wcscat
wcscpy
_stricmp
wcsstr
_wcslwr
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeQuerySystemTime
IoDeviceObjectType
strncpy
PsLookupProcessByProcessId
wcschr
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeQueryTimeIncrement
ZwCreateFile
MmGetSystemRoutineAddress
ZwSetInformationFile
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 61B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ