Static task
static1
Behavioral task
behavioral1
Sample
WSDScan.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
WSDScan.exe
Resource
win10v2004-20230220-en
General
-
Target
WSDScan.sys
-
Size
25KB
-
MD5
efb32ce8f17b4743b4cd76778bc66f1f
-
SHA1
0d0239c15c99a6cfb81466c8a7e148183bcccca3
-
SHA256
ca070d0bed90edc890dbafa7778001b9dc042efa8ae17ddebba1f46cb61b6fc8
-
SHA512
aa96e91562751c210047f53e5966ee5e81d4ce915e49e023e55d6ee0b7b0860be361fb3c2f247e1e3521859938ab5cbb1aad8324f587103cdc63ca2bd618469b
-
SSDEEP
384:1P9B0q0a58oN+CmkTzZ5Dk5LiqSfCS9lEncT/+7Y1P2+btjTd2Gvpd7pFuBW6Cw2:1US5N5D82lP281e+dd5L7p+0w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WSDScan.sys
Files
-
WSDScan.sys.exe windows x64
4abe8db7a23e1c9ce8d7be99a195a165
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
IoRegisterDeviceInterface
KeAcquireSpinLockRaiseToDpc
IoSetDeviceInterfaceState
IoDetachDevice
RtlFreeUnicodeString
RtlInitUnicodeString
KeInitializeSpinLock
IoOpenDeviceRegistryKey
IoDeleteDevice
RtlCopyUnicodeString
PoSetPowerState
IoGetDevicePropertyData
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
KeReleaseSpinLock
KeSetEvent
ExAllocatePool2
ExFreePool
KeClearEvent
IoGetDeviceProperty
MmGetSystemRoutineAddress
IoCreateDevice
IofCallDriver
IoWMIRegistrationControl
KeInitializeEvent
IofCompleteRequest
KeWaitForSingleObject
IoReleaseCancelSpinLock
ZwClose
ZwSetValueKey
ZwOpenKey
IoAllocateWorkItem
PoCallDriver
PoRequestPowerIrp
IoFreeWorkItem
IoQueueWorkItem
PoStartNextPowerIrp
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 562B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GFIDS Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ