_ResetVirtualMemory@4
_SetVirtualMemory@4
Static task
static1
1 signatures
General
-
Target
d452d22829632592cc5159572d022f31
-
Size
30KB
-
MD5
d452d22829632592cc5159572d022f31
-
SHA1
11a82babcfaf97bbe6897ba63e003892e2016f57
-
SHA256
28a7f8cc2a0f5b1fd0de484270b3f4e9dd82862485f3e6f168dad332e17454ea
-
SHA512
d1ae070bfeb4e39270ed882d764fff4028864c510e2bc8df066e68dec966280ff955e51e385d0d664bf15221dd9263354e90308a21f0ac0ba6d67c51ab24f209
-
SSDEEP
768:RPyZ5eOHhotnpfZFFHYIdNwCiKLOA1brH27nvvHk:RPikOBunpfZVtFqA1/+
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d452d22829632592cc5159572d022f31
Files
-
d452d22829632592cc5159572d022f31.sys windows:5 windows x86 arch:x86
6d67c9b96797949f07ff48b276781f2a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExReinitializeResourceLite
ExAcquireResourceExclusiveLite
ExFreePoolWithTag
ExAllocatePool
ExAcquireResourceSharedLite
ExInitializeResourceLite
ExAcquireSharedStarveExclusive
KeClearEvent
ObGetObjectSecurity
ExUuidCreate
VerSetConditionMask
ZwQuerySymbolicLinkObject
strstr
RtlIntegerToUnicodeString
KeSetEvent
KeInitializeEvent
ZwCreateDirectoryObject
ZwPowerInformation
ZwDeleteValueKey
RtlInitString
RtlCompareString
ZwSetInformationFile
wcsstr
RtlAppendUnicodeStringToString
KeWaitForSingleObject
ZwDeleteFile
RtlCharToInteger
IoAllocateIrp
RtlCopyUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
wcsncmp
ZwQueryInformationFile
ZwDeleteKey
ZwOpenSection
ObReferenceObjectByPointer
memset
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.code Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ecode Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ