Static task
static1
General
-
Target
bc35b529fe4a0ad3a20b1a3442a34080
-
Size
5KB
-
MD5
bc35b529fe4a0ad3a20b1a3442a34080
-
SHA1
593ea10f84719234a448acf392cd204a554091ca
-
SHA256
577cf4c3d55c9e6526b929be5c6f2d0d1863794289986de5df629df2af9f4185
-
SHA512
da38558c1d26a4d02c188d9e7c42b431e23fb1204f081fdb1c8d9d9349be90c2ff3ee0159e4f5f0a01345a3b5d12d0ac3cb9ca1a7ab9b87ad02baaf165b1df03
-
SSDEEP
96:mHhkv2jzK/e2wNkFlio0ona+bMFO3oleffBy7gQa64Piw/g8amZm99T0j:xUInlgIa8fBy7gQW/g8xZg9Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc35b529fe4a0ad3a20b1a3442a34080
Files
-
bc35b529fe4a0ad3a20b1a3442a34080.sys windows:4 windows x86 arch:x86
3261f0ae8982ee0978a3a39860aa2c40
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
InbvAcquireDisplayOwnership
IoCheckEaBufferValidity
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetDeviceObjectPointer
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoStopTimer
ObCreateObject
ObDereferenceObject
ObFindHandleForObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObSetSecurityDescriptorInfo
PfxFindPrefix
PoSetSystemState
PsEstablishWin32Callouts
PsTerminateSystemThread
ZwAccessCheckAndAuditAlarm
ZwClose
ZwOpenDirectoryObject
MmUserProbeAddress
KeServiceDescriptorTable
IoDriverObjectType
DbgPrint
Exfi386InterlockedDecrementLong
Exfi386InterlockedExchangeUlong
Exfi386InterlockedIncrementLong
InterlockedCompareExchange
InterlockedExchangeAdd
InterlockedIncrement
IofCompleteRequest
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 672B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ