Static task
static1
General
-
Target
b83cc5b2c1bc557994ebde1142cfc0f1
-
Size
3KB
-
MD5
b83cc5b2c1bc557994ebde1142cfc0f1
-
SHA1
e9cb6db1ca29f2357613be3f3025a0a38d0852c9
-
SHA256
b575a54fc3a0e0491fb9119e35b1765def4232826ab5c489dc3663866e075aea
-
SHA512
ee52d5fa2e0f6ab409a035ed36f098d1494353af3e4060f3bcad9a9aeee4cbe70c4b50c7340e2c7b7b5a410d9cb25b03c28196000b11797a085db5b7c2749ff8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b83cc5b2c1bc557994ebde1142cfc0f1
Files
-
b83cc5b2c1bc557994ebde1142cfc0f1.sys windows:5 windows x86 arch:x86
4ca267531edcb8dd7ef89a9eb4c7c1c2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeSetEvent
KeDelayExecutionThread
memmove
KeWaitForSingleObject
RtlFreeAnsiString
_stricmp
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByHandle
IofCompleteRequest
MmUnmapIoSpace
MmMapIoSpace
MmGetPhysicalAddress
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
KeInitializeEvent
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 992B - Virtual size: 965B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 288B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 576B - Virtual size: 564B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 160B - Virtual size: 158B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ