Static task
static1
General
-
Target
c7cf85b5e13b066c117b72c93dbdc9a3
-
Size
22KB
-
MD5
c7cf85b5e13b066c117b72c93dbdc9a3
-
SHA1
ef90417f18f5c0209495bc4c73089ee892dde158
-
SHA256
610cb868e249743f92494583240c41928cbae40ca83c93b70c3188abe5c09648
-
SHA512
85d368f806cc663b5b0bd1567defddfe3684d6b301e4ee0dff1afae01150c3f7f87320c687637819c68d891fd88ae0f126c8666b3729bd49b9da9b8065d600fb
-
SSDEEP
384:LPX6MN+R0JevnjyvXoZLJH1SVZzBMzXU8YnZsCXdnxMal+qkN5Ttduy9WgdDJrQp:LPX6MN+R+eO/o5dAVlBIk8YnZ7XdnxFD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7cf85b5e13b066c117b72c93dbdc9a3
Files
-
c7cf85b5e13b066c117b72c93dbdc9a3.sys windows:4 windows x86 arch:x86
3e3438ebac9353e8698ecbb1b7d08d90
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwDeleteValueKey
RtlInitUnicodeString
KeDelayExecutionThread
_except_handler3
PsCreateSystemThread
ZwQueryValueKey
ZwOpenKey
_strnicmp
wcsncmp
wcslen
towlower
toupper
strstr
srand
strrchr
isprint
isdigit
isupper
isxdigit
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
atol
PsGetVersion
tolower
atoi
strchr
islower
strncmp
IoGetCurrentProcess
strncpy
isspace
wcsstr
IofCompleteRequest
ExFreePool
wcscpy
ZwEnumerateKey
wcscat
ExAllocatePoolWithTag
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
IoRegisterDriverReinitialization
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ