passthruparser[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

passthruparser.sys
Size

24KB
MD5

87982b2e89ed926e57f876420f10bbd9
SHA1

94e0c4907f2066b2c66556efc770c8d98c0167ea
SHA256

46bdc76a51a8020c4f90ab72818b464f5160b1b682e2ee65e776f556be2d25c9
SHA512

b95008841b8175fd87cc131636fbcfc400462b2dc9e1c8b262a491e79e399655db46c0768744a4b4a50592612a9a7065badb05fcd759c7ee314a9726604757ba
SSDEEP

384:xu2b7i6XYJONgqyFT+9BHr14PPCRcES8vRtEyaOxCZZvQW6xWv+r:0Oi6XYJPIBH5YKRRvRr9Sg

Score

N/A

Malware Config

Signatures

Files

passthruparser.sys
.exe windows x64

1c0602474eef173e3a6e56f946a2e859

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoAllocateWorkItem
KeReleaseInStackQueuedSpinLock
KeAcquireSpinLockRaiseToDpc
IoSynchronousCallDriver
KeEnterCriticalRegion
IoFreeIrp
MmBuildMdlForNonPagedPool
ObfDereferenceObject
IoAllocateMdl
RtlInitUnicodeString
KeInitializeSpinLock
ExAcquirePushLockExclusiveEx
ExReleasePushLockExclusiveEx
KeReleaseSpinLock
IoFileObjectType
MmAllocateMappingAddress
MmSizeOfMdl
ObReferenceObjectByHandle
IoFreeMdl
IoCreateFile
ObfReferenceObject
MmGetSystemRoutineAddress
IoAllocateIrp
IoReuseIrp
IoFreeWorkItem
ExAllocatePoolWithTag
MmFreeMappingAddress
ExFreePoolWithTag
IoWMIRegistrationControl
IoGetDeviceInterfaces
ZwClose
IoGetAttachedDeviceReference
KeAcquireInStackQueuedSpinLock
RtlCompareMemory
KeLeaveCriticalRegion
IoBuildPartialMdl
MmMapLockedPagesWithReservedMapping
MmUnmapReservedMapping
IoQueueWorkItemEx
IofCallDriver
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoInitializeIrp
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject

storvsp.sys

VstorRegisterParser
VstorCompleteScsiRequest

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 667B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c0602474eef173e3a6e56f946a2e859

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

storvsp.sys

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 232B

.pdata Size: 1024B - Virtual size: 528B

.idata Size: 2KB - Virtual size: 2KB

PAGE Size: 4KB - Virtual size: 4KB

INIT Size: 1024B - Virtual size: 667B

GFIDS Size: 512B - Virtual size: 84B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 40B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 232B

.pdata
Size: 1024B - Virtual size: 528B

.idata
Size: 2KB - Virtual size: 2KB

PAGE
Size: 4KB - Virtual size: 4KB

INIT
Size: 1024B - Virtual size: 667B

GFIDS
Size: 512B - Virtual size: 84B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 40B