e:\drivers\kaola\ver2\regti\dd\objfre_w2K_x86\i386\prtrege.pdb
Static task
static1
General
-
Target
77d65881f4b2f57e63666a9ff8f70df0
-
Size
24KB
-
MD5
77d65881f4b2f57e63666a9ff8f70df0
-
SHA1
e95e09ec4b5f0451fbd5b383e1d6c9416bca00b8
-
SHA256
9ee10623a55b2a922c8142b1650290606d94883206643808bcbddef22323df07
-
SHA512
3ed612104eb24e4156dd26702c0142b11b9329ea597f4ab7befdbeb2833b1ae1e8e82b4f681b452ee756b44293574d45ed0de0267ab97ebd4a471711708d14dc
-
SSDEEP
384:7Bag5Jgo+6lHEeO7sv6BwiUDOBQ6BDJumaWeqVQ5y:9uo+6lHrNd6Q6BDAHqQy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77d65881f4b2f57e63666a9ff8f70df0
Files
-
77d65881f4b2f57e63666a9ff8f70df0.sys windows:5 windows x86 arch:x86
b2ff71b62f2d2d90c48d4ee79e047a53
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
KeSetEvent
ZwClose
ZwSetInformationFile
sprintf
ZwWriteFile
ExAllocatePoolWithTag
ExFreePool
KeWaitForSingleObject
ExQueueWorkItem
KeReleaseMutex
ObReferenceObjectByHandle
ObfDereferenceObject
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncmp
ObQueryNameString
strstr
ZwSetValueKey
ZwDeleteKey
ZwDeleteValueKey
ZwCreateFile
ExSystemTimeToLocalTime
KeQuerySystemTime
_except_handler3
IofCompleteRequest
IoUnregisterShutdownNotification
IoDeleteDevice
IoDeleteSymbolicLink
ZwOpenKey
ZwQueryValueKey
IoRegisterShutdownNotification
KeInitializeEvent
KeServiceDescriptorTable
KeInitializeMutex
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
IoGetCurrentProcess
strncpy
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ