Static task
static1
General
-
Target
adce0ac8e1fd45aac9bc835ab456103b
-
Size
40KB
-
MD5
adce0ac8e1fd45aac9bc835ab456103b
-
SHA1
a3355abf6f1c9cb8c84ee75378b1b521d3a3b29f
-
SHA256
e8dd4b71b20023b68c0fd02dd4553ae01f652091146d380b170a85b04fdd5c5b
-
SHA512
e81a8a2f42c514fa2aac40e3ce9bba8ae37d9271da6a7e50a9716da660d29c6a1d31460cc4996597a5b08354b7bf2d5d8ee5df864a953844377d249f075a729a
-
SSDEEP
768:sqkYxuPA1Z+aRmsB2ihKIXtC67RZL9LoR+oZ7M1Q4HBCUIODfbQPp0nK:s/oW0JhHtCqRFB+dZ7M1Q4cUIODfMPpZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adce0ac8e1fd45aac9bc835ab456103b
Files
-
adce0ac8e1fd45aac9bc835ab456103b.sys windows:4 windows x86 arch:x86
bf16d1acfe67e8500a0edd068a0cacbd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
ExAllocatePoolWithTag
ZwClose
ObfDereferenceObject
ZwDeleteKey
swprintf
_wcsnicmp
wcslen
RtlInitUnicodeString
strncmp
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
wcsncpy
wcsrchr
strncpy
PsLookupProcessByProcessId
_stricmp
IoGetCurrentProcess
_wcsicmp
KeTickCount
KeQueryTimeIncrement
ZwSetValueKey
ZwCreateKey
PsSetCreateProcessNotifyRoutine
ZwQueryValueKey
RtlCopyUnicodeString
ZwSetInformationFile
ZwCreateFile
wcscpy
PsGetVersion
RtlCompareUnicodeString
_snwprintf
wcschr
IoRegisterDriverReinitialization
RtlAnsiStringToUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
KeDelayExecutionThread
KeQuerySystemTime
IofCompleteRequest
MmGetSystemRoutineAddress
wcscat
PsCreateSystemThread
wcsstr
_wcslwr
_snprintf
IoDeviceObjectType
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ