Static task
static1
General
-
Target
71792c39427f45d3d582accacb9a1a01190bfbb28e8a136b2da8bfd851729197
-
Size
3.1MB
-
MD5
fec47957890ecff936c8ade2e090d1ac
-
SHA1
bcb7621d3448e13b6fcff95cd21ea4619dc8bbeb
-
SHA256
71792c39427f45d3d582accacb9a1a01190bfbb28e8a136b2da8bfd851729197
-
SHA512
500af00684195e4812b2cb966fc953251104319e73344fc207e04d9dfca10b72b93fd6336f4e8b7e0914d088154d1a185a80d569956bb8def48dc8d9d0b2f86c
-
SSDEEP
49152:VOahDpkt4P0CEwm+jgaRMtiBt9uYNBujNazd0s+RgVlM3GtzvnPA1JTNOI:UahoxCngaRzt7gjN4kp2i1Nh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71792c39427f45d3d582accacb9a1a01190bfbb28e8a136b2da8bfd851729197
Files
-
71792c39427f45d3d582accacb9a1a01190bfbb28e8a136b2da8bfd851729197.sys windows:10 windows x64 arch:x64
54da4ac7975036645a50036053a15e06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
NtQuerySystemInformation
RtlInitUnicodeString
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
_wcsicmp
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
IoGetDeviceObjectPointer
ZwClose
MmIsAddressValid
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ObReferenceObjectByName
ZwQuerySystemInformation
__C_specific_handler
MmHighestUserAddress
IoDriverObjectType
KeQueryTimeIncrement
KeStackAttachProcess
KeUnstackDetachProcess
PsGetProcessWow64Process
PsGetProcessPeb
MmUnlockPages
MmGetSystemRoutineAddress
MmUnmapLockedPages
IoFreeMdl
ZwTerminateProcess
PsGetProcessImageFileName
ObOpenObjectByPointer
PsReferenceProcessFilePointer
IoQueryFileDosDeviceName
ZwQueryVirtualMemory
MmProbeAndLockPages
PsLookupProcessByProcessId
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoGetCurrentProcess
MmCopyVirtualMemory
KeClearEvent
KeSetEvent
KeWaitForSingleObject
MmMapLockedPages
ObReferenceObjectByHandle
PsSetCreateProcessNotifyRoutineEx
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
ExEventObjectType
ObRegisterCallbacks
ObUnRegisterCallbacks
ObGetFilterVersion
IoThreadToProcess
strcmp
PsProcessType
PsThreadType
RtlGetVersion
ObfReferenceObject
ObGetObjectType
ExEnumHandleTable
ExfUnblockPushLock
_snprintf
vsprintf_s
ZwCreateFile
ZwWriteFile
PsLookupThreadByThreadId
NtQueryInformationThread
DbgPrint
KeDelayExecutionThread
KdDisableDebugger
KdChangeOption
PsCreateSystemThread
PsTerminateSystemThread
KdDebuggerEnabled
PsGetVersion
KeInitializeEvent
RtlCopyUnicodeString
ObfDereferenceObject
ExReleaseFastMutex
ExAcquireFastMutex
MmBuildMdlForNonPagedPool
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
wdfldr.sys
WdfVersionBindClass
WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
hal
KeQueryPerformanceCounter
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.h1b0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.h1b1 Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.h1b2 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ