Static task
static1
General
-
Target
9c2db5fbcc7dd35701036858bb876fec
-
Size
29KB
-
MD5
9c2db5fbcc7dd35701036858bb876fec
-
SHA1
19609db5ceafaac0440b4644be381aca1a169ff2
-
SHA256
817c4a169bc6be2685d6a4cc7356e308b0cce6cd6fec03b67b8091780a9a6881
-
SHA512
64f9c658296f53c4b92664bf254681c5751cf22a91e23dca981d37b25db345215d22e9260059267e1ba4682aa9216d045319e198e67699eef2477f5b9c8e2777
-
SSDEEP
768:ecGd1f1/Aqw/WDDhjNo8mNUG5Xr2wnA89NInP5r:ebdlFDHgtuG92wA89NSh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c2db5fbcc7dd35701036858bb876fec
Files
-
9c2db5fbcc7dd35701036858bb876fec.sys windows:4 windows x86 arch:x86
4aeea6a8f71d6eb09c8df5e12bede6df
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strncmp
IoGetCurrentProcess
swprintf
wcscat
wcscpy
_stricmp
strncpy
RtlCopyUnicodeString
RtlInitUnicodeString
_wcsnicmp
wcslen
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ExFreePool
ExAllocatePoolWithTag
IofCompleteRequest
ZwUnmapViewOfSection
RtlAnsiStringToUnicodeString
_snprintf
ZwQuerySystemInformation
MmIsAddressValid
_except_handler3
RtlCompareUnicodeString
MmGetSystemRoutineAddress
_strnicmp
ObfDereferenceObject
ObQueryNameString
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 686B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ