Static task
static1
General
-
Target
d85ba5aaa77abacea55e4f520244ede0N.exe
-
Size
37KB
-
MD5
d85ba5aaa77abacea55e4f520244ede0
-
SHA1
8ec7acec7694faaaf23d440c015b43ed9a939dbe
-
SHA256
91d236ae0a59be545665bb996db8188f131960dda50eeff41ec5c13435b4f656
-
SHA512
c290293de97d7e14cbf37aab37ebd02a6a35ae7d5187ffc5573b9ec4a950737e65f7c248a712eb4a00d33ac0fd44d5f94856ded2e1d1a7cb14e255b312e0347f
-
SSDEEP
768:tR5kKaL6CIOsUsrMqwAiSXr21P4Ilz/CJGSjqmztPAhH/xzDpKl:9lmTIKsrviSIP4q+EJmzEH/hDpK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d85ba5aaa77abacea55e4f520244ede0N.exe
Files
-
d85ba5aaa77abacea55e4f520244ede0N.exe.sys windows:4 windows x86 arch:x86
d2906efc15eef330923018b13b09ca62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
wcslen
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
ZwCreateFile
swprintf
MmIsAddressValid
KeQuerySystemTime
RtlCopyUnicodeString
MmGetSystemRoutineAddress
PsCreateSystemThread
strncpy
PsLookupProcessByProcessId
_stricmp
ExFreePool
_snprintf
ExAllocatePoolWithTag
wcsstr
_wcslwr
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
PsSetCreateProcessNotifyRoutine
_wcsicmp
wcsncpy
wcsrchr
ObReferenceObjectByHandle
KeDelayExecutionThread
ObfDereferenceObject
strncmp
KeTickCount
KeQueryTimeIncrement
RtlCompareUnicodeString
_snwprintf
wcschr
_wcsnicmp
ZwDeleteKey
wcscat
wcscpy
RtlAnsiStringToUnicodeString
ZwSetInformationFile
IoDeviceObjectType
IoGetCurrentProcess
ZwCreateKey
IoRegisterDriverReinitialization
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 64B - Virtual size: 49B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ