_Restore_DataMemory@4
_Validate_DataMemory@8
Static task
static1
1 signatures
General
-
Target
d7bdfe163ab857520beb32ebbf27f75c
-
Size
30KB
-
MD5
d7bdfe163ab857520beb32ebbf27f75c
-
SHA1
054b6a56b291ffa5bac6e1e7bf2c43552f47a228
-
SHA256
d3feaeb7b700f80aef7cd3caf29510f322e9ff7b1be70df26a902822018c4907
-
SHA512
68d0ac2067888e8134bc64c50bad9841b8b50752ccb4007cd5600eb8e839d309b4ee1952cb037c56f1931d03ff0c470a1e76d95df7b29f51bec1229f27b69917
-
SSDEEP
384:kE74Ayy7xr08OI7by0NSYvI91kjuqlgnSyYdSYpB2hx0FXADItnEhppCYw/UQ6:FkAyy10xyW1V91kRiidfkkFXMxPRwP6
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d7bdfe163ab857520beb32ebbf27f75c
Files
-
d7bdfe163ab857520beb32ebbf27f75c.sys windows:5 windows x86 arch:x86
7b37f4b366426dfa7873d394c2ea1e8e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExReinitializeResourceLite
ExAcquireResourceExclusiveLite
ExFreePoolWithTag
ExAllocatePool
ExAcquireResourceSharedLite
ExInitializeResourceLite
ExAcquireSharedStarveExclusive
ObGetObjectSecurity
ExUuidCreate
VerSetConditionMask
ZwQuerySymbolicLinkObject
strstr
RtlIntegerToUnicodeString
ZwCreateDirectoryObject
ZwPowerInformation
ZwDeleteValueKey
RtlInitString
RtlCompareString
ZwSetInformationFile
wcsstr
RtlAppendUnicodeStringToString
ZwDeleteFile
RtlCharToInteger
IoAllocateIrp
RtlCopyUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
wcsncmp
ZwQueryInformationFile
ZwDeleteKey
ZwOpenSection
ObReferenceObjectByPointer
memset
Exports
Exports
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.code Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ecode Size: 512B - Virtual size: 119B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 222B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ