Static task
static1
General
-
Target
a3ab8bb5bd004530147d381cb728b0d2
-
Size
39KB
-
MD5
a3ab8bb5bd004530147d381cb728b0d2
-
SHA1
0df609c7c0522d7cc6e2f8bed1536c0a4ae10d92
-
SHA256
e49c149e24546162c4b94b1a23e378b3fcaf7c3727c5f624281baffee3a25fa7
-
SHA512
c87a4817214e63fba9e8da044e901a8a08d7f1edd4b393687aa885058795242055f85ff198d7a05458c9f640a2baa48128f2ee8262b0554bf3d0eddb2eddcae2
-
SSDEEP
768:dFS3yF0d080vFX+nslHo85LSLucJcsPUxKLhjcN42y9IzRKE+eJul6v:b84l+n8I85gJcyUxKLhjcN4l9IFkg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3ab8bb5bd004530147d381cb728b0d2
Files
-
a3ab8bb5bd004530147d381cb728b0d2.sys windows:4 windows x86 arch:x86
8940ba25fb0a7ab855cf5763489fef2e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ObfDereferenceObject
MmIsAddressValid
ZwClose
ZwCreateFile
RtlInitUnicodeString
swprintf
RtlCopyUnicodeString
_wcsicmp
wcsncpy
wcslen
wcsrchr
ZwQueryValueKey
ZwOpenKey
ZwSetInformationFile
wcscpy
_stricmp
wcsstr
_wcslwr
ZwSetValueKey
ObReferenceObjectByHandle
IoGetCurrentProcess
PsGetVersion
_wcsnicmp
KeQuerySystemTime
wcscat
_except_handler3
ZwDeleteKey
IoDeviceObjectType
KeTickCount
KeQueryTimeIncrement
IoRegisterDriverReinitialization
PsCreateSystemThread
MmGetSystemRoutineAddress
ExFreePool
ExAllocatePoolWithTag
strncmp
_snwprintf
wcschr
KeDelayExecutionThread
RtlCompareUnicodeString
_snprintf
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
strncpy
RtlAnsiStringToUnicodeString
ZwCreateKey
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsLookupProcessByProcessId
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 62B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ