Static task
static1
General
-
Target
b8c6e38e5483280879c7ecf513cec243
-
Size
39KB
-
MD5
b8c6e38e5483280879c7ecf513cec243
-
SHA1
c60b1628d635107e0493a80b736c541430deaa91
-
SHA256
dbbacaeaa8c97307b78de939e72b11f43991f6f07a8793d48ed9f7f55b3a9c19
-
SHA512
75333cc154264a59304d175c8609dcd69a0770a1ff3005f85a29e92fb705cf5006d825eb2ba2f910cb3eec6c2b4cc1d038533e4dab394c2ef1ffdc5ee71752d1
-
SSDEEP
768:SdrQXdv6+S1b+sC0XMKhpratwarXkn5+cytAFqlwLAeeBnUB0/veshLe2:SdrQZjS1b3XZpexOJytAF+MAeeBna0xX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8c6e38e5483280879c7ecf513cec243
Files
-
b8c6e38e5483280879c7ecf513cec243.sys windows:4 windows x86 arch:x86
047fc214506bf18da4579de456ee4928
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IoRegisterDriverReinitialization
KeDelayExecutionThread
KeQuerySystemTime
RtlInitUnicodeString
strncpy
IoGetCurrentProcess
ZwClose
PsGetVersion
strncmp
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
ZwOpenKey
wcsncpy
wcsrchr
_stricmp
swprintf
wcsstr
_wcslwr
ZwSetValueKey
PsLookupProcessByProcessId
RtlCompareUnicodeString
ZwQueryValueKey
MmGetSystemRoutineAddress
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwDeleteKey
_snwprintf
wcslen
wcschr
RtlCopyUnicodeString
KeTickCount
KeQueryTimeIncrement
PsCreateSystemThread
ExFreePool
_snprintf
ExAllocatePoolWithTag
_except_handler3
wcscat
wcscpy
_wcsnicmp
ZwCreateFile
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
_wcsicmp
IoDeviceObjectType
IofCompleteRequest
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 81B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ