ipsec.pdb
Static task
static1
1 signatures
General
-
Target
85a63dfd54618161e887a0892342b493
-
Size
73KB
-
MD5
85a63dfd54618161e887a0892342b493
-
SHA1
5cca7db4dc98b7adc3682db1d68b0111577643db
-
SHA256
58041acd897e56893da8b52024327e267eccfa85e62ab90c7f0f5762b158b6d7
-
SHA512
20acfbb58aa6d335673ab61132462fa5fe148c004064b2191d328bf031f30e9407e8805dd1ff71462407ce934d8e78cecee5f54ff96028b51d2c62eb3b401e06
-
SSDEEP
768:qOFn+koR1/KUJbxoki0pRsgFfin8x4Bu+7tstQACXn4RIcF55Sv1dw7MVRW44cfp:nnSRq5GbE8x4BZstQiFuuMe4f4
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85a63dfd54618161e887a0892342b493
Files
-
85a63dfd54618161e887a0892342b493.sys windows:5 windows x86 arch:x86
3b838288bb06dd95d5d887532fb636c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
hal
KfAcquireSpinLock
KfReleaseSpinLock
KfLowerIrql
ndis.sys
NdisCancelTimer
NdisWriteEventLogEntry
NdisSetTimer
NdisInitializeTimer
ntoskrnl.exe
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IofCompleteRequest
KeQuerySystemTime
RtlExtendedIntegerMultiply
ZwClose
MmIsThisAnNtAsSystem
ExInitializeNPagedLookasideList
IoDeleteDevice
IoDeleteSymbolicLink
KeDelayExecutionThread
IoAcquireCancelSpinLock
IoCreateSymbolicLink
IoCreateDevice
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
ObfDereferenceObject
RtlAnsiStringToUnicodeString
RtlIntegerToUnicodeString
IoReleaseCancelSpinLock
KeTickCount
KeBugCheckEx
wcslen
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
MmBuildMdlForNonPagedPool
MmSizeOfMdl
ExDeleteNPagedLookasideList
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
InterlockedPushEntrySList
memmove
ExQueueWorkItem
_allshl
MmMapLockedPagesSpecifyCache
ExInitializeResourceLite
ExDeleteResourceLite
ZwDeviceIoControlFile
ZwLoadDriver
ZwCreateFile
RtlSplay
RtlDelete
KeCancelTimer
_alldiv
KeSetTimerEx
KeInitializeTimer
KeInitializeDpc
KeQueryTimeIncrement
ExInterlockedAddLargeStatistic
InterlockedPopEntrySList
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ