Static task
static1
General
-
Target
7a716bb0ed5cbdbe46c1f422d75254d4
-
Size
39KB
-
MD5
7a716bb0ed5cbdbe46c1f422d75254d4
-
SHA1
1870a984e12abeab0a1602b8712ec3dd27369400
-
SHA256
774e8f7242245da7b7939ffa5f8a69262d5413bd51dc9ba87e2f106b9e9c8c42
-
SHA512
4f4c85168a89befe647f343b9d2557d1cbb8b8d6e4583469e34e7d833faeed20ab8c9da635915edf72f73739da8d91d96ba5d3d22cf34e84f2fc40b3bc3e32c8
-
SSDEEP
768:Wpfg9jAoLKMPCXNtbjY4q8Msxfno9Hi0FwTG6QWtx2OowriNwEq9KKn/80+y6:WpfijAYKdXvo4UsxP21IGhWiOoQiNrMf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a716bb0ed5cbdbe46c1f422d75254d4
Files
-
7a716bb0ed5cbdbe46c1f422d75254d4.sys windows:4 windows x86 arch:x86
61b9f5dc11a5eac78702b6b81b1a747f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlCompareUnicodeString
RtlInitUnicodeString
ZwClose
ZwDeleteKey
ZwOpenKey
_stricmp
swprintf
wcsstr
_wcslwr
ZwSetValueKey
ZwSetInformationFile
ZwCreateFile
wcslen
wcscpy
strncmp
KeTickCount
KeQueryTimeIncrement
strncpy
PsLookupProcessByProcessId
_wcsnicmp
ObfDereferenceObject
IoRegisterDriverReinitialization
_snwprintf
wcsncpy
wcschr
_wcsicmp
wcscat
ZwQueryValueKey
PsCreateSystemThread
_except_handler3
KeQuerySystemTime
MmGetSystemRoutineAddress
IoGetCurrentProcess
ZwCreateKey
KeDelayExecutionThread
MmIsAddressValid
ObReferenceObjectByHandle
wcsrchr
PsGetVersion
PsSetCreateProcessNotifyRoutine
RtlCopyUnicodeString
ExAllocatePoolWithTag
IofCompleteRequest
ExFreePool
IoDeviceObjectType
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_snprintf
RtlAnsiStringToUnicodeString
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 74B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ