Static task
static1
General
-
Target
c30dc9468ccbad25cbab3b4f3f7fce7d
-
Size
27KB
-
MD5
c30dc9468ccbad25cbab3b4f3f7fce7d
-
SHA1
c6e1cfd725be3a6b42ecbb072a24c9c75aaa804a
-
SHA256
90f8a465626c38f92de65220df0d20cb1ec55a3275a38240ff3af442b2ffcea2
-
SHA512
b440f819ace6032ed9b0af487f5975d453892b20529dd3161d899920eb5ec17ac3a0968297da90afe02966cdaf10412a46e207e7da9c80b932968f3916ccf7cb
-
SSDEEP
768:JL+gOV3Nfx62yPqnGFmxiGo8TNpIHXJxXPA1:VvOV3lPy/XyMI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c30dc9468ccbad25cbab3b4f3f7fce7d
Files
-
c30dc9468ccbad25cbab3b4f3f7fce7d.sys windows:5 windows x86 arch:x86
33e934b05811686f4ab7c2c0b737d344
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
_except_handler3
_wcsnicmp
wcslen
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
IoGetCurrentProcess
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
PsGetVersion
strncmp
strncpy
KeDelayExecutionThread
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
IoRegisterDriverReinitialization
_strnicmp
wcsncmp
towlower
ZwDeleteValueKey
IofCompleteRequest
wcsstr
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 800B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ