S7-700[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

S7-700.sys
Size

6KB
MD5

8eb4e452c95d73dad2cd6c5ec4a697f6
SHA1

4b76ece7064e912e2893a657ae27fdbd0d5001a8
SHA256

081b7d2b81942805a440ea80f0d78d5ae3be04c4ef7cddc1341ef4713a09157c
SHA512

a81f10db89d720320c30b36d30f8c98943e24d661c6f464f09a9a485181e1644e555fce681bb848dd5366388e1999eb22f188d240fd72b5a0d2f3a41dc11bc77
SSDEEP

48:Sh7Q+4nSNhe79Miz00C55phkhHkcndSzLPRbmTgkejwJg/BWp+p2jMqPkBwCiDdg:sQLSNsLnEzLPGJgBQI2ATqxS9

Score

1^/10

Malware Config

Signatures

Files

S7-700.sys
.exe windows x86

a59b9b271a3e7cff2b355f11e824d50e

Code Sign

18:b2:da:8d:2e:b0:51:9e:42:17:8c:5a:f8:00:98:e7
Certificate

Issuer

CN=WDKTestCert user\,131633723904014781

Not Before

17/02/2018, 20:19

Not After

17/02/2028, 00:00

Subject

CN=WDKTestCert user\,131633723904014781

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

96:68:24:c7:ea:05:18:ae:e3:c6:ca:20:b7:61:58:83:7b:57:05:8a
Signer

Actual PE Digest

96:68:24:c7:ea:05:18:ae:e3:c6:ca:20:b7:61:58:83:7b:57:05:8a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=WDKTestCert user\,131633723904014781

27/02/2023, 09:32
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

DbgPrint
MmMapLockedPagesSpecifyCache
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
PsLookupProcessByProcessId

Sections

.text
Size: 1024B - Virtual size: 533B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 374B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a59b9b271a3e7cff2b355f11e824d50e

Code Sign

18:b2:da:8d:2e:b0:51:9e:42:17:8c:5a:f8:00:98:e7Certificate

Extended Key Usages

Key Usages

96:68:24:c7:ea:05:18:ae:e3:c6:ca:20:b7:61:58:83:7b:57:05:8aSigner

Signature Validations

Verification

27/02/2023, 09:32 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 1024B - Virtual size: 533B

.rdata Size: 1024B - Virtual size: 676B

.data Size: 512B - Virtual size: 28B

INIT Size: 512B - Virtual size: 374B

.reloc Size: 512B - Virtual size: 100B

18:b2:da:8d:2e:b0:51:9e:42:17:8c:5a:f8:00:98:e7
Certificate

96:68:24:c7:ea:05:18:ae:e3:c6:ca:20:b7:61:58:83:7b:57:05:8a
Signer

27/02/2023, 09:32
Valid: false

.text
Size: 1024B - Virtual size: 533B

.rdata
Size: 1024B - Virtual size: 676B

.data
Size: 512B - Virtual size: 28B

INIT
Size: 512B - Virtual size: 374B

.reloc
Size: 512B - Virtual size: 100B