Static task
static1
General
-
Target
aa6c0ea287487472cf60ff9882fee366
-
Size
40KB
-
MD5
aa6c0ea287487472cf60ff9882fee366
-
SHA1
5375cd0397a867028bbc93d5001cd648080b5c92
-
SHA256
61d8d3e3dc1dc2e419ef1c712786a19b376ccef12128a286adeb6979890f0d1d
-
SHA512
34bdfdda008aacb5b730a3999825b9d76c9ded8fcf509fa1477394f75c53504acef59b5a5ccb312fadbc5f0042f3f2d53a67eef8b60df07b1220b8d4946a9563
-
SSDEEP
768:F2+lYJkbGxj5GI9A5PTfjIv7HPyCsJf7X1Ojztey1Z8alF0RtaRy:4mYJkgjD9A5vIbifitBCjRv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa6c0ea287487472cf60ff9882fee366
Files
-
aa6c0ea287487472cf60ff9882fee366.sys windows:4 windows x86 arch:x86
b4b098683c248489e9d33dbcdf26234f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
swprintf
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
ZwClose
PsCreateSystemThread
wcslen
wcscat
wcscpy
RtlCompareUnicodeString
ZwDeleteKey
ZwOpenKey
ZwSetInformationFile
ZwCreateFile
wcsstr
_wcslwr
wcsncpy
MmIsAddressValid
IoGetCurrentProcess
PsGetVersion
ZwQueryValueKey
KeDelayExecutionThread
KeQuerySystemTime
_wcsicmp
wcsrchr
ExFreePool
_snprintf
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
IoDeviceObjectType
strncmp
_snwprintf
wcschr
RtlAnsiStringToUnicodeString
ZwSetValueKey
_except_handler3
RtlCopyUnicodeString
ObfDereferenceObject
ObReferenceObjectByHandle
strncpy
PsLookupProcessByProcessId
_stricmp
ZwCreateKey
_wcsnicmp
KeTickCount
KeQueryTimeIncrement
IofCompleteRequest
PsSetCreateProcessNotifyRoutine
IoRegisterDriverReinitialization
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEALL Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ