__ExAllocatePool@0
___ExFreePool@0
Static task
static1
1 signatures
General
-
Target
20372550e8a100a6ba6ff6ce2a700967
-
Size
30KB
-
MD5
20372550e8a100a6ba6ff6ce2a700967
-
SHA1
0065569765d2e1175a23fe440ead4a4b1571db32
-
SHA256
ddae36447ea01ca2752f45bafcd8ee9848b66383b971763076191ed371079699
-
SHA512
1db63b344e1ce0234d898beeaa18e6cacf1a3e65140bdf74a2b870e79fc30ce660a08ceaff04cdf748ab96bca55ae9ba8c0191e8fc9f90a9c84ad702a32a9980
-
SSDEEP
768:vIFVXmQbDoHOpQBJcrU69QzLg9VR4qvt9k/X:vMlmQvnal6uzkz2SOX
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20372550e8a100a6ba6ff6ce2a700967
Files
-
20372550e8a100a6ba6ff6ce2a700967.sys windows:5 windows x86 arch:x86
b3ebfb5d15724940fea2f34adea33522
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePool
ZwDisplayString
IoAttachDeviceByPointer
KeCancelTimer
ZwCreateTimer
IoGetDeviceObjectPointer
KeWaitForSingleObject
RtlExtendedMagicDivide
RtlCheckRegistryKey
KeInitializeDpc
_strnicmp
KeInitializeTimer
strncpy
RtlInitUnicodeString
RtlSubtreeSuccessor
RtlAnsiStringToUnicodeString
_allmul
memset
MmRemovePhysicalMemory
MmGetPhysicalMemoryRanges
MmGetPhysicalAddress
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.datac Size: 1024B - Virtual size: 546B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 596B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ