driver(1)[.]sys | Triage

Sharing

General

Target

driver(1).sys
Size

4KB
MD5

837dfeccf6df521ded4a3887350199e4
SHA1

f510b60a506f0a170a224c52dbe43ae322951a30
SHA256

1095e7583f2ee8f34713e5e96d5449f2e4d125d9ea2d479de341885062d33426
SHA512

d4b4b6f82a9cd4cd520ae9c9ee30e050c2540266a275a513995fddd6a2a87584fb4f619e9f492352b706fdd97ec32a22654e1d86c96e6756b00802efc82cd081
SSDEEP

96:vsCel1mlqN9vqj98kxOK42gsuUr6eSrgUf:vp21ps2Bem

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
driver(1).sys

Files

driver(1).sys
.exe windows x86

a46f16a73a80054a5c6f146b98f15f65

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

strncpy
IoGetCurrentProcess
RtlCompareMemory
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
IofCompleteRequest
ZwQuerySystemInformation
ZwQueryDirectoryFile
KeServiceDescriptorTable
KeTickCount
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 512B - Virtual size: 414B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ