Static task
static1
General
-
Target
614cabfc9db32ce08726a01399053cbaf16253f51c0078f742e14f1a872d14f8
-
Size
39KB
-
MD5
21b16aa2ebedecf35db8864d09e84b4b
-
SHA1
1ce911201c8272f3632a9e7504f77e2cfd1f1c26
-
SHA256
614cabfc9db32ce08726a01399053cbaf16253f51c0078f742e14f1a872d14f8
-
SHA512
8baa3c0966f7f044831b66d57e3fc66ebcb99850acb4673fb2d13807b210a653d1d7085863f7be2438b2ef27c9abfb67fc5b57e8e8b186c95a2c3152315c4034
-
SSDEEP
768:D0ySPS2RNWrMz8K5LBRhjjTEs24MylNbe1VXKVTefzS7Y5ncjlSfXUNP+E6:g3PRvhzDLBR5jTEs24MylNOVXK6zSD25
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 614cabfc9db32ce08726a01399053cbaf16253f51c0078f742e14f1a872d14f8
Files
-
614cabfc9db32ce08726a01399053cbaf16253f51c0078f742e14f1a872d14f8.sys windows:4 windows x86 arch:x86
b907025344099bcf2dc4b143461a8a6e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeTickCount
KeQueryTimeIncrement
_stricmp
IofCompleteRequest
strncpy
PsLookupProcessByProcessId
wcslen
swprintf
wcscat
wcscpy
RtlInitUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
_snwprintf
ExAllocatePoolWithTag
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByHandle
wcsncpy
wcsrchr
ExFreePool
_snprintf
wcschr
KeQuerySystemTime
wcsstr
_wcslwr
_wcsnicmp
strncmp
IoGetCurrentProcess
KeDelayExecutionThread
ZwSetValueKey
ZwCreateKey
RtlCopyUnicodeString
_except_handler3
_wcsicmp
IoDeviceObjectType
ZwDeleteKey
IoRegisterDriverReinitialization
PsGetVersion
ZwSetInformationFile
ZwCreateFile
PsCreateSystemThread
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
MmGetSystemRoutineAddress
PsSetCreateProcessNotifyRoutine
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 96B - Virtual size: 74B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ