Static task
static1
General
-
Target
c31d6c41de608d0500a2b7e081602323
-
Size
37KB
-
MD5
c31d6c41de608d0500a2b7e081602323
-
SHA1
6077d410bcde1ab77f49fffdfb65b6c8f0dd9249
-
SHA256
7508947530879c4cf6fff0522a7f92c0002339f3dca3e94b8a8f82e8fa7e3c6c
-
SHA512
e2fe17d408af113be2337cb18f7ad50914ebfdeda77bcac7961c2932a1e385b81fa2170ef6a9bfd9dab1af3bcf4627808b2ce73222627be5985451f15ce02e1e
-
SSDEEP
768:RUiMI9cSTQ/icqUpvoElak7m0B/J9SGY2K7qotNqbeHUOuGf6V0eaTbeDESvacr:h1CvicVKEsRSx9SGYR7qozqwUg2L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c31d6c41de608d0500a2b7e081602323
Files
-
c31d6c41de608d0500a2b7e081602323.sys windows:4 windows x86 arch:x86
ea98528a6437b612abd8abbd7d3157d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
wcslen
ZwCreateKey
RtlInitUnicodeString
swprintf
wcsncpy
wcsrchr
_stricmp
wcsstr
_wcslwr
ZwOpenKey
ZwSetValueKey
_snwprintf
wcschr
ZwDeleteKey
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
KeQuerySystemTime
IofCompleteRequest
ZwQueryValueKey
_except_handler3
PsCreateSystemThread
ExAllocatePoolWithTag
ZwCreateFile
RtlCompareUnicodeString
strncpy
IoGetCurrentProcess
RtlAnsiStringToUnicodeString
ObReferenceObjectByHandle
wcscat
wcscpy
KeTickCount
_wcsicmp
RtlCopyUnicodeString
_wcsnicmp
ObfDereferenceObject
MmIsAddressValid
KeQueryTimeIncrement
ZwSetInformationFile
KeDelayExecutionThread
PsLookupProcessByProcessId
IoDeviceObjectType
strncmp
ExFreePool
_snprintf
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 91B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ