Driver.pdb
Static task
static1
1 signatures
General
-
Target
c0c48afa5c73e1f1c9226433669ccfcfa66322594f9f01bf35cbe5cf3afd9514.exe
-
Size
18KB
-
MD5
4566f3f0ac157b737adae4e7d529016e
-
SHA1
2280abe8f52ebcefe820444763851fd795b196ce
-
SHA256
c0c48afa5c73e1f1c9226433669ccfcfa66322594f9f01bf35cbe5cf3afd9514
-
SHA512
47d8a753bcbcf31c9b17351644efee4dd3def6df06ea299b7667900d1cb868fd8e64b49bf8f1e025500dfc9392a7b997b1b4a769e07275fa5d37c2d899d1efb1
-
SSDEEP
192:JLYcItJdArddX4kI4G2NSeYkHY55qqndELtEp38pCv41wIrruL:JL5ItJCxOkt5KqqnOmpspCgZrruL
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0c48afa5c73e1f1c9226433669ccfcfa66322594f9f01bf35cbe5cf3afd9514.exe
Files
-
c0c48afa5c73e1f1c9226433669ccfcfa66322594f9f01bf35cbe5cf3afd9514.exe.sys windows:4 windows x64 arch:x64
b7af0a650122b15c55b5641212884ed2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
DbgPrint
ExAllocatePool
ExFreePoolWithTag
IoAllocateIrp
IoCreateDevice
IoCreateDriver
IoCreateFile
IoCreateSymbolicLink
IoDriverObjectType
IoFileObjectType
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetFileObjectGenericMapping
IofCallDriver
IofCompleteRequest
KeInitializeEvent
KeSetEvent
KeStackAttachProcess
KeUnstackDetachProcess
KeWaitForSingleObject
MmBuildMdlForNonPagedPool
MmCopyVirtualMemory
MmCreateMdl
MmGetPhysicalAddress
MmGetSystemRoutineAddress
MmIsAddressValid
MmMapIoSpace
MmUnmapIoSpace
ObCreateObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObfDereferenceObject
PsGetProcessPeb
PsGetProcessWow64Process
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlFreeAnsiString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
SeCreateAccessState
ZwAllocateVirtualMemory
ZwClose
ZwFreeVirtualMemory
ZwOpenProcess
ZwTerminateProcess
strcmp
strlen
wcscpy
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
llvmmsvc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ