Static task
static1
General
-
Target
f5cf20a8f7d30684665dc0e3c3e15fb0ab37051a42c79b2162e36258678c4c76N
-
Size
40KB
-
MD5
de92148542a8b509618fc907b05031e0
-
SHA1
2a1b4c0c9923130ab2a0fb541b92cb4eae37abaf
-
SHA256
f5cf20a8f7d30684665dc0e3c3e15fb0ab37051a42c79b2162e36258678c4c76
-
SHA512
a9ff270c5f86ac7c8016731acf78e01924e68c587491529583ba599815ffd791162e9ba02ce54bd67be99daca52f559253844535d75a4fec48ff24d797068d33
-
SSDEEP
768:qSBXbu7zu1x8C5Fuw6hbAgIjcitxsp7oaSa/stk/X+rfq5dFdFdxdTo:qAbazuoC5Fz6ygIQitK8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5cf20a8f7d30684665dc0e3c3e15fb0ab37051a42c79b2162e36258678c4c76N
Files
-
f5cf20a8f7d30684665dc0e3c3e15fb0ab37051a42c79b2162e36258678c4c76N.sys windows:4 windows x86 arch:x86
1d7a4791f5e129b74b85f529331b3221
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetValueKey
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
_except_handler3
swprintf
_wcsicmp
_wcsnicmp
wcslen
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
RtlAnsiStringToUnicodeString
wcscat
wcscpy
ZwSetInformationFile
ZwCreateFile
IoDeviceObjectType
PsCreateSystemThread
ZwCreateKey
ZwDeleteKey
ExFreePool
ExAllocatePoolWithTag
_snwprintf
PsGetVersion
wcsstr
_wcslwr
IoGetCurrentProcess
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
strncmp
RtlCompareUnicodeString
RtlCopyUnicodeString
wcschr
_snprintf
strncpy
PsLookupProcessByProcessId
_stricmp
IoRegisterDriverReinitialization
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
KeQuerySystemTime
KeDelayExecutionThread
KeTickCount
KeQueryTimeIncrement
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 77B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 8B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGESYS Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ