c:\dbk\objfre_wxp_x86\i386\WelleN.pdb
Static task
static1
1 signatures
General
-
Target
86d06ecde3bbddb06a0d4ed1cace4569
-
Size
35KB
-
MD5
86d06ecde3bbddb06a0d4ed1cace4569
-
SHA1
cd0e89c46e41649a6f4fba9e94f50d4b7ee9a317
-
SHA256
8c50ba6d462d075e72f1800f9662a04801fd7363fd7fd8baeaae918ff62e14c6
-
SHA512
dca594d1aee6e4c4ef70d8174e88739d1b544ddd945b8a8ac47b2bbe7e52e4ba345895eff164c02da797bebf5ff792c34c77be3c017e5ce28521b616288404e7
-
SSDEEP
384:AIUREffIH+QhyknZvR7EzNClUiaqBa++WQLLQHiBeCAJy/7VdrwPv778KsF8wqEf:AIGh9nZ5RedWi/5d8shqaB6x+
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 86d06ecde3bbddb06a0d4ed1cace4569
Files
-
86d06ecde3bbddb06a0d4ed1cace4569.sys windows:6 windows x86 arch:x86
6d7f787952f065f52de3a08e7b957df7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeInsertQueueApc
KeInitializeApc
ExAllocatePool
IofCompleteRequest
ObReferenceObjectByHandle
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
KeDetachProcess
ZwAllocateVirtualMemory
KeAttachProcess
PsSetCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwOpenProcess
PsSetLoadImageNotifyRoutine
MmAllocateNonCachedMemory
MmFreeNonCachedMemory
KeUnstackDetachProcess
MmGetPhysicalAddress
KeStackAttachProcess
ZwClose
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenSection
RtlInitUnicodeString
ObfDereferenceObject
MmMapLockedPagesSpecifyCache
KeDelayExecutionThread
IoAllocateMdl
ZwOpenThread
ObOpenObjectByPointer
PsProcessType
PsLookupProcessByProcessId
memset
memcpy
IoDeleteSymbolicLink
IoDeleteDevice
IoAllocateWorkItem
IoCreateSymbolicLink
IoCreateDevice
ZwQueryValueKey
ZwOpenKey
PsGetCurrentProcessId
IoGetCurrentProcess
RtlFreeAnsiString
RtlUpperString
RtlUnicodeStringToAnsiString
PsLookupThreadByThreadId
KeClearEvent
KeSetEvent
KeWaitForSingleObject
KeReleaseSemaphore
KeTickCount
ExFreePoolWithTag
DbgPrint
MmProbeAndLockPages
KeGetCurrentThread
RtlUnwind
KeBugCheckEx
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ