Static task
static1
General
-
Target
989456cd1f1044ac5cbe82b6a381c270
-
Size
40KB
-
MD5
989456cd1f1044ac5cbe82b6a381c270
-
SHA1
48fa1bbac2b6fc72e22caf0134ba281fd3252d94
-
SHA256
e6be8bf47708eb28cbb45651933ffcef2c2a78d0354a1789c9d2211ce61c7ed3
-
SHA512
508cc8880a7e7c7fff75ad6efbc9a850415c7cb77773362daf7d3271ef9f0c136c167bad9d99eff7d20e02789cd689ae13cba3bd64dab7fb0ab30dd9aacdbf28
-
SSDEEP
768:YtkITIBN3z5QkOnDFIh9kbK9WALEobQXsaBWhxEi+CU5NXfi9Udfckjdkfl0:Ytk7qmhmbzWPYsEh5ByUV3yf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 989456cd1f1044ac5cbe82b6a381c270
Files
-
989456cd1f1044ac5cbe82b6a381c270.sys windows:4 windows x86 arch:x86
0cf30c8e4495581e0e76577216b9ce8d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
_snwprintf
ExAllocatePoolWithTag
RtlInitUnicodeString
ExFreePool
_snprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
swprintf
_wcsnicmp
wcslen
ObfDereferenceObject
RtlCompareUnicodeString
IoRegisterDriverReinitialization
_stricmp
wcsstr
_wcslwr
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
ZwSetValueKey
strncmp
KeDelayExecutionThread
KeQuerySystemTime
ZwClose
ObReferenceObjectByHandle
ZwOpenKey
wcsrchr
ZwCreateKey
IoDeviceObjectType
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
wcscat
wcscpy
strncpy
PsLookupProcessByProcessId
_except_handler3
RtlAnsiStringToUnicodeString
ZwCreateFile
KeTickCount
KeQueryTimeIncrement
_wcsicmp
RtlCopyUnicodeString
MmGetSystemRoutineAddress
ZwSetInformationFile
wcschr
IofCompleteRequest
ZwDeleteKey
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 96B - Virtual size: 65B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ