Static task
static1
General
-
Target
7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376
-
Size
46KB
-
MD5
bd5b0514f3b40f139d8079138d01b5f6
-
SHA1
73bac306292b4e9107147db94d0d836fdb071e33
-
SHA256
7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376
-
SHA512
b714c10884891ad15769cc4d60ef1957738c9681b04e1fc03996c3264446fde7888fb901e3066ccbf59b6058d6a4344158e79872100699d3614db4f892c7398e
-
SSDEEP
768:RLJNjwM2VhYcdoxcKpTQjsP0J270ocs5/Nb4Ml5D5:tT2VhXoNhMJc15/NUM3D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376
Files
-
7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376.sys windows:4 windows x86 arch:x86
1827eb38c1eb7ae936693db7c42567cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
ZwClose
IofCompleteRequest
KeResetEvent
InterlockedIncrement
KeSetEvent
InterlockedDecrement
RtlUnicodeStringToInteger
RtlInitUnicodeString
KeInitializeEvent
wcsncmp
wcscat
wcslen
wcscpy
MmBuildMdlForNonPagedPool
IoAllocateMdl
strlen
RtlCompareUnicodeString
IoFreeMdl
MmProbeAndLockPages
MmUnlockPages
MmUnmapLockedPages
RtlFreeUnicodeString
ZwWriteFile
ZwCreateFile
RtlAnsiStringToUnicodeString
strcat
ZwReadFile
ZwQueryInformationFile
strncmp
_wcsnicmp
strcmp
_stricmp
MmGetSystemRoutineAddress
ZwQueryValueKey
ZwOpenKey
IoCreateFile
KeWaitForMultipleObjects
strcpy
RtlUnwind
vsprintf
KeWaitForSingleObject
KeDelayExecutionThread
PsTerminateSystemThread
PsCreateSystemThread
ObReferenceObjectByHandle
ExFreePool
KeInitializeSpinLock
KeTickCount
memset
memcpy
MmMapLockedPages
ExAllocatePoolWithTag
PsGetVersion
ZwTerminateProcess
ZwOpenProcess
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlCreateSecurityDescriptor
ZwWaitForSingleObject
NtFsControlFile
NtWriteFile
NtReadFile
RtlLengthRequiredSid
RtlImageDirectoryEntryToData
ZwQueryInformationProcess
ZwQuerySystemInformation
PsLookupProcessByProcessId
KeAttachProcess
KeDetachProcess
PsLookupThreadByThreadId
KeInitializeApc
KeInsertQueueApc
ZwOpenFile
ZwDeviceIoControlFile
PsThreadType
NtQuerySystemInformation
hal
KfAcquireSpinLock
KfReleaseSpinLock
ndis.sys
NdisAllocateMemory
NdisAllocatePacket
NdisCopyFromPacketToPacket
NdisFreePacket
NdisAllocateBuffer
NdisDeregisterProtocol
NdisRegisterProtocol
NdisAllocateBufferPool
NdisAllocatePacketPool
NdisFreeBufferPool
NdisFreePacketPool
NdisFreeMemory
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 775KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ