Static task
static1
General
-
Target
a22589548159322a5d686909fcf0f7b4
-
Size
31KB
-
MD5
a22589548159322a5d686909fcf0f7b4
-
SHA1
5d8367bd4c4641ca018f11322a0b12e127046be6
-
SHA256
90519096429816f457d52a3f1d4af0cb3399b0f62a47d660349afec86ee43a0c
-
SHA512
df07d2d10d48aa7467f654d6c59523be7e0092fecc0f1f5e7fbd049b01d18792e9ac0d576fe28a0464fc758883069250a51301631cc042f9a733e457cec88c3a
-
SSDEEP
768:6q13gORZ8pRRnAbbpQztllScx3PCxzeatNpDmlf:v13ghpRRAbto/lSnxzTXtml
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a22589548159322a5d686909fcf0f7b4
Files
-
a22589548159322a5d686909fcf0f7b4.sys windows:4 windows x86 arch:x86
b5bd547b71035ea7a56ca7467f6d104c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
PsCreateSystemThread
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
PsGetVersion
_strnicmp
strncmp
strncpy
ZwQueryValueKey
ZwOpenKey
_except_handler3
wcsstr
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ExFreePool
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
wcsncmp
towlower
ZwDeleteValueKey
KeDelayExecutionThread
wcscat
wcscpy
ZwEnumerateKey
IoRegisterDriverReinitialization
IofCompleteRequest
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 800B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ