C:\SYS源码\sys\i386\SSDT.pdb
Static task
static1
General
-
Target
793d7624c61b8c6ff56de1334e882a87
-
Size
339KB
-
MD5
793d7624c61b8c6ff56de1334e882a87
-
SHA1
2c6bf0b92555124163ca0f4ab9379fd181fe9f33
-
SHA256
ae3e293d1bd823adfd7c6aee3b88f2aec5ec3bfd19d9635b1afc00cbba4d2e8b
-
SHA512
736aebf4f7906f76afba5f8a57909d5c56111135afb6abf3114e101427499f5063c0b142f1068693521195948ea129ce5be16bb6e6ec8132b1b5ecaf88d10854
-
SSDEEP
6144:vgOf8bbs11y4RAVHv+r/wDIT7ucBOBkOQQsgO:IOAbmy4RAVPpq7PHOQF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 793d7624c61b8c6ff56de1334e882a87
Files
-
793d7624c61b8c6ff56de1334e882a87.sys windows:5 windows x86 arch:x86
77fcc78af53f9ae16078a753cbac0775
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
ProbeForRead
DbgPrint
KeServiceDescriptorTable
_except_handler3
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 183B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 384B - Virtual size: 304B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ