Static task
static1
General
-
Target
d143fee58db6ab15da18a3c18113c8b0N
-
Size
26KB
-
MD5
d143fee58db6ab15da18a3c18113c8b0
-
SHA1
35ec8a8460f2889b88f9a950cb14c078b18c2e8f
-
SHA256
2605eef4e51d7e5c63830f4a019d4a28ae5d67448bd65c2fe32a31ba284d0bbb
-
SHA512
6518fdb567a6e8919def7ac12259f239de8d14f559b10812d970238beb4a9f86c5a096b11cfabd824890b365a938228afb69681ac280a0a68f07ec0cb8e6020a
-
SSDEEP
768:w301KUf+/Zm0M/4ECAXPN6UscW7nDfkZbm96PT9lvelJ6ZuAH+QFvNa:wE1rf+/Zm0M/zCakUsZ7nb4bm96PT9lr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d143fee58db6ab15da18a3c18113c8b0N
Files
-
d143fee58db6ab15da18a3c18113c8b0N.sys windows:5 windows x86 arch:x86
f24a0f0ec7813fca8c7c35d9fe50570f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePool
ZwClose
ZwWriteFile
ZwSetInformationFile
ZwReadFile
ExAllocatePoolWithTag
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
wcsncmp
wcslen
towlower
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsCreateSystemThread
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
_strnicmp
wcsstr
ZwQueryValueKey
ZwOpenKey
_except_handler3
wcscpy
ZwEnumerateKey
wcscat
KeDelayExecutionThread
ObfDereferenceObject
ObQueryNameString
ObReferenceObjectByHandle
RtlCompareUnicodeString
ExGetPreviousMode
KeServiceDescriptorTable
ZwSetValueKey
IofCompleteRequest
ZwDeleteValueKey
IoRegisterDriverReinitialization
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 768B - Virtual size: 740B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ