Static task
static1
General
-
Target
74c1fd0d4d14e6e6bf421a40e1196c9fe0e4bc703bd15f1c339e1e5d376b2bb0N
-
Size
39KB
-
MD5
1c281e18fb189d84579824ef9135d490
-
SHA1
029edb8df212a64d63fa837142128cfe2587efe1
-
SHA256
74c1fd0d4d14e6e6bf421a40e1196c9fe0e4bc703bd15f1c339e1e5d376b2bb0
-
SHA512
0f8b37351ba7eca05a963f21cd018601f7a32b45d0c13f341f2dff935af4d552d0bfbb848fee03c89341ff900afbc6d88766231df85a0f365ed5efce3860a688
-
SSDEEP
768:VRY9U9haCvL1srcb4VgorNl617y25WyhJ3xqQSPB0+/WWeoF+V:o9US4L1i/g7ysW4TvI09++V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74c1fd0d4d14e6e6bf421a40e1196c9fe0e4bc703bd15f1c339e1e5d376b2bb0N
Files
-
74c1fd0d4d14e6e6bf421a40e1196c9fe0e4bc703bd15f1c339e1e5d376b2bb0N.sys windows:4 windows x86 arch:x86
71aa47099e68e41e3652a7d83c6af315
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwClose
ZwSetInformationFile
ZwCreateFile
RtlInitUnicodeString
wcslen
wcscpy
swprintf
RtlCopyUnicodeString
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
_except_handler3
RtlAnsiStringToUnicodeString
wcsstr
_wcslwr
IoRegisterDriverReinitialization
MmGetSystemRoutineAddress
_stricmp
wcscat
_wcsicmp
RtlCompareUnicodeString
ExFreePool
ExAllocatePoolWithTag
ObfDereferenceObject
IofCompleteRequest
MmIsAddressValid
_wcsnicmp
_snwprintf
wcsncpy
wcschr
ObReferenceObjectByHandle
strncmp
IoGetCurrentProcess
PsGetVersion
strncpy
PsSetCreateProcessNotifyRoutine
KeTickCount
KeQueryTimeIncrement
PsLookupProcessByProcessId
ZwDeleteKey
PsCreateSystemThread
ZwCreateKey
wcsrchr
KeDelayExecutionThread
KeQuerySystemTime
IoDeviceObjectType
_snprintf
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGEWMI Size: 32B - Virtual size: 10B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEDRV Size: 32B - Virtual size: 3B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 64B - Virtual size: 50B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 736B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ