Static task
static1
General
-
Target
8f74eff818d8b6a1ac2d98d66d715039
-
Size
40KB
-
MD5
8f74eff818d8b6a1ac2d98d66d715039
-
SHA1
35b7297b537e145a861579c7950f0c4131ec91ee
-
SHA256
9a3886b675f56e1100a06c71a358f7f9c48a656bac05bd7abfac1f4df4b9d6c1
-
SHA512
dac1b7cd0ea596bcef0dbdc19354c2187764fe9e3f00409d7a392e2282ef5cbac23b538dd196b9dc5167c1905014640f3785fcb3b8662499773cdc0692e1e13a
-
SSDEEP
768:2Adsf2r0iIxrYdpa0lAu3vHqG07pHxuSUTsGqIVXXhq8cGhrFy+nx6SBX20yP+UZ:ZdsfW0iIyz9GuSfpUT/qIVXXo8xyo527
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8f74eff818d8b6a1ac2d98d66d715039
Files
-
8f74eff818d8b6a1ac2d98d66d715039.sys windows:4 windows x86 arch:x86
06ecd57d83c81f46880b86d5c3f24bdd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeQuerySystemTime
ZwSetValueKey
IofCompleteRequest
ZwClose
ZwCreateKey
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
strncpy
IoGetCurrentProcess
_wcsicmp
wcsncpy
wcslen
wcsrchr
MmIsAddressValid
PsGetVersion
ZwQueryValueKey
ZwSetInformationFile
ZwCreateFile
wcscpy
swprintf
KeTickCount
KeQueryTimeIncrement
_stricmp
ObReferenceObjectByHandle
RtlCompareUnicodeString
ZwOpenKey
ObfDereferenceObject
_wcsnicmp
ExFreePool
ExAllocatePoolWithTag
ZwDeleteKey
PsSetCreateProcessNotifyRoutine
RtlCopyUnicodeString
IoRegisterDriverReinitialization
PsLookupProcessByProcessId
strncmp
wcscat
_except_handler3
_snwprintf
PsCreateSystemThread
_snprintf
wcschr
MmGetSystemRoutineAddress
wcsstr
_wcslwr
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 41B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ