Static task
static1
General
-
Target
979d7a6b5fa7a487eb19e7b1f9d80570
-
Size
40KB
-
MD5
979d7a6b5fa7a487eb19e7b1f9d80570
-
SHA1
6cf8f04134ae0cc19d453e26d99d8a4f84e832eb
-
SHA256
e2034038acd35258c1e1e4c021d5eac04a3e19a3eb2f993321bd93cba316ea26
-
SHA512
ee631578f8fb5b73f7c0d2d7e595b4146080ea249391a2816f8645a093a6b9cd14061417e668bc3fcdf68b73e2c257c12ebd7602b04544a9140a9cf72cd4fdca
-
SSDEEP
768:Q8S0gLB5Haan65LPTIJvD7cDbqGMu90WNU9MhugBlAruZ56uc8zKpsPBCxoa:vxWJ65gpDA/qm90Wr83re6N8QsPwxoa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 979d7a6b5fa7a487eb19e7b1f9d80570
Files
-
979d7a6b5fa7a487eb19e7b1f9d80570.sys windows:4 windows x86 arch:x86
c128a832ba8a2ba85aacae33ac75dc20
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetInformationFile
ZwCreateFile
RtlInitUnicodeString
wcslen
wcscpy
swprintf
PsSetCreateProcessNotifyRoutine
KeQuerySystemTime
strncmp
_snwprintf
wcsncpy
wcschr
ZwSetValueKey
ZwQueryValueKey
ZwOpenKey
_except_handler3
RtlAnsiStringToUnicodeString
ObfDereferenceObject
_wcsicmp
ZwCreateKey
wcsrchr
IoRegisterDriverReinitialization
wcsstr
_wcslwr
MmIsAddressValid
strncpy
IoGetCurrentProcess
_wcsnicmp
RtlCompareUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
IofCompleteRequest
wcscat
ZwDeleteKey
ExFreePool
ExAllocatePoolWithTag
IoDeviceObjectType
PsGetVersion
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
_stricmp
ObReferenceObjectByHandle
_snprintf
MmGetSystemRoutineAddress
PsCreateSystemThread
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 5B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 60B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ