Static task
static1
General
-
Target
a43bb2c01eb787a65452e317f5156074
-
Size
21KB
-
MD5
a43bb2c01eb787a65452e317f5156074
-
SHA1
1defab6d1cfcb0115acdbd74bef445409129ca38
-
SHA256
5d6178ade1bafadf730765656563ed88a1d2e881936e56301ea7bf1dffae9400
-
SHA512
ab87a15d58d3c073a22fd61a0d5d024329f9f834b0e381135a521e4de674c9d405806933d67f28e952818e7ed6e2c80254c33b5e5efc630e1929c526e9587f8f
-
SSDEEP
384:Dbn4zCIlJNeEMSKolpP7ViT+Jrg20Voewo+u0jCp4Luo1vaqpm3CvW:Db4zCOJNeEMSKolpP78HWe+FcIDvJpm3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a43bb2c01eb787a65452e317f5156074
Files
-
a43bb2c01eb787a65452e317f5156074.sys windows:5 windows x86 arch:x86
2297553c2be1e462b6220d901cde88ec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDelayExecutionThread
ZwClose
ZwCreateKey
wcslen
swprintf
RtlInitUnicodeString
wcscat
wcscpy
strncmp
IoGetCurrentProcess
_wcsnicmp
_snprintf
ExFreePool
ExAllocatePoolWithTag
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
ZwCreateFile
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
PsGetVersion
_wcslwr
wcsncpy
PsTerminateSystemThread
PsCreateSystemThread
_stricmp
strncpy
PsLookupProcessByProcessId
KeInitializeTimer
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmIsAddressValid
ZwUnmapViewOfSection
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 960B - Virtual size: 958B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 576B - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ