Static task
static1
General
-
Target
d430e099fcc2de62b12f431cc0956c16
-
Size
5KB
-
MD5
d430e099fcc2de62b12f431cc0956c16
-
SHA1
791975ae6bbbba6c76ec25ec7bf4cdfa4b5ab453
-
SHA256
64d1d7512916236e5f453cba76bd9ee59596843afeedeaa8f47d1c26c3dcdda7
-
SHA512
c03dd1f77e35c126fb9c64e31f5ff8247961daccda8a0a2cc08afb22c495c7949514aed37cb70b4d8878be1cde6943f45ee5a68f8c539ee5b405c74d8437a131
-
SSDEEP
96:uxo8s6E08wNyW0n7nzICprO3oleffBy7gQa60vc9/g8amZi9H:Qozx/W0nLhIfBy7gQUW/g8xZid
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d430e099fcc2de62b12f431cc0956c16
Files
-
d430e099fcc2de62b12f431cc0956c16.sys windows:4 windows x86 arch:x86
2a316615fee05fb505be6af1fc0fbe84
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
CcCopyRead
ExAllocatePool
ExInitializeZone
InbvAcquireDisplayOwnership
IoAllocateErrorLogEntry
IoCheckEaBufferValidity
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoGetDeviceObjectPointer
IoInitializeIrp
IoRegisterDriverReinitialization
IoRegisterFileSystem
IoStopTimer
ObCreateObject
ObDereferenceObject
ObFindHandleForObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObSetSecurityDescriptorInfo
PfxFindPrefix
PoSetSystemState
PsEstablishWin32Callouts
PsGetCurrentProcessId
PsLookupProcessByProcessId
PsTerminateSystemThread
SeLockSubjectContext
ZwAccessCheckAndAuditAlarm
ZwClose
ZwOpenDirectoryObject
ZwQueryEaFile
ZwSetValueKey
MmUserProbeAddress
KeServiceDescriptorTable
IoDriverObjectType
DbgPrint
IofCompleteRequest
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 736B - Virtual size: 717B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 192B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ