Static task
static1
General
-
Target
8dc4b79564d7ec4f60b95f2825b6be60
-
Size
27KB
-
MD5
8dc4b79564d7ec4f60b95f2825b6be60
-
SHA1
50f1fc8c825e46df72d9d9c5afc212d17f36fbe5
-
SHA256
98cc05fa21ca3691640b16d29b4194b7a9a4955d679658179cd9dcceaf86795d
-
SHA512
5b90649b46b4cd5b380941555f2e6002f177e062a0877a475452b875431ba2efe8b6794cad5f8ee942d84df8aff5ff66af6d1bf290a97eb15c918ea3ba657b90
-
SSDEEP
384:kZ6MNSaLOUQ2Vt6IXvAvhKgG2GbGtaEHF027QgTZW7JcFo9ezZnZt:w6HaLOUQAtlXM/+qwEHF02hI7eoiP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8dc4b79564d7ec4f60b95f2825b6be60
Files
-
8dc4b79564d7ec4f60b95f2825b6be60.sys windows:4 windows x86 arch:x86
60a92641473eee86b2990f26ddecea6b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
swprintf
_except_handler3
wcscat
wcslen
ZwUnmapViewOfSection
ObfDereferenceObject
ObQueryNameString
_stricmp
RtlCompareUnicodeString
IofCompleteRequest
_wcsnicmp
_strnicmp
MmIsAddressValid
wcscpy
strncpy
ExFreePool
ExAllocatePoolWithTag
RtlAnsiStringToUnicodeString
IoGetCurrentProcess
RtlCopyUnicodeString
strncmp
MmGetSystemRoutineAddress
_snprintf
ZwQuerySystemInformation
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 686B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ