Static task
static1
General
-
Target
bded258da41fedeff383a66d95c2400b
-
Size
27KB
-
MD5
bded258da41fedeff383a66d95c2400b
-
SHA1
00d3a90e245ba754f9d9ad7455af6521c833488d
-
SHA256
7eea754823d5bb7eabf3d76c161cbb0f1bfd621cdb5d686512d4c1afd3298647
-
SHA512
e8949a12a417e649affcb04945ec92eb7e4d44470d9c8fa68ff6a3504c5257d1f71101c68829b216ba218804afa058cf19913993df3f07a2fbf797c88ad370c5
-
SSDEEP
384:qET7vZM0ItYOu3b/lUY0BRkDG590hlUgMPPLyR/ra2ailhW/jRGbsqX1rRHWM1Ko:9UtnurWN4DG590hGgS6D9aUQ7S1HWM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bded258da41fedeff383a66d95c2400b
Files
-
bded258da41fedeff383a66d95c2400b.sys windows:4 windows x86 arch:x86
f155773d6eea4e97ba0b22e88554248a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
RtlInitUnicodeString
RtlCopyUnicodeString
MmIsAddressValid
RtlCompareUnicodeString
ObfDereferenceObject
ObQueryNameString
_strnicmp
swprintf
wcscat
wcscpy
_stricmp
strncpy
RtlAnsiStringToUnicodeString
strncmp
IoGetCurrentProcess
wcslen
ExFreePool
ExAllocatePoolWithTag
_wcsnicmp
_snprintf
ZwQuerySystemInformation
ZwUnmapViewOfSection
_except_handler3
IofCompleteRequest
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
MmGetSystemRoutineAddress
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 704B - Virtual size: 700B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ