Static task
static1
General
-
Target
VirusShare-016bc17192488cc9b3c14ed608fde670
-
Size
40KB
-
MD5
016bc17192488cc9b3c14ed608fde670
-
SHA1
f7b4bb39106f11cba81c30a574632e95e029edb1
-
SHA256
ea5dceb4266dc649b210914eef6bf39e2c909e02035f32e8b868b5ffd9e38d40
-
SHA512
873050bd15fcdf25dab8c04a84ea8aa333648caa8ef5ef78f3eaff7bd8a3322938795c5a8595fa67cd7a2e59bd0f92543bcc897b779da24215c5cf656179e68d
-
SSDEEP
768:rejbeNXf5vU7HL5wd3h3QA2lWoEzi52cnXsh0x/va9BXECUzDhNZ7F:2bqf5vkjTlB+i5qhM/UxUzNN1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VirusShare-016bc17192488cc9b3c14ed608fde670
Files
-
VirusShare-016bc17192488cc9b3c14ed608fde670.sys windows:4 windows x86 arch:x86
d7731e7602260ca585cd357596857234
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmIsAddressValid
_wcsicmp
wcslen
wcscat
wcscpy
ZwClose
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
strncpy
PsLookupProcessByProcessId
_stricmp
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
ZwSetValueKey
ZwCreateKey
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
_snwprintf
wcsncpy
wcschr
ZwCreateFile
swprintf
MmGetSystemRoutineAddress
_wcsnicmp
ZwDeleteKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
IofCompleteRequest
RtlCompareUnicodeString
PsGetVersion
ZwSetInformationFile
IoGetCurrentProcess
ObReferenceObjectByHandle
strncmp
_snprintf
wcsrchr
KeQuerySystemTime
KeDelayExecutionThread
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
wcsstr
_wcslwr
RtlCopyUnicodeString
PsCreateSystemThread
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDATA Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 43B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ