Driver.pdb
Static task
static1
1 signatures
General
-
Target
4566f3f0ac157b737adae4e7d529016e.bin
-
Size
7KB
-
MD5
ed4f8d575db73b4232261bb2c3ce8614
-
SHA1
9eb6c259d5215c59fe46c11b2b1ff3ed43e9eec8
-
SHA256
a372561a0219a5c08e7ad118b00ae8c1a403992b19a92cef0ef3f2b9dd698921
-
SHA512
83b935a250d8e6591a6dea39adefd508c6da0c1ba741393d7b813a31e7ed32543980f0ef7f70ae6d70ed1ff78d78365c1669d8ef431cd61e98a0b2ca59b238ae
-
SSDEEP
192:XhJM8skY5LVy9frxklO2dErr3/RltBaFTj96JhE:XhJMVXUf64330n0JK
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c0c48afa5c73e1f1c9226433669ccfcfa66322594f9f01bf35cbe5cf3afd9514.exe
Files
-
4566f3f0ac157b737adae4e7d529016e.bin.zip
Password: infected
-
c0c48afa5c73e1f1c9226433669ccfcfa66322594f9f01bf35cbe5cf3afd9514.exe.sys windows:4 windows x64 arch:x64
b7af0a650122b15c55b5641212884ed2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
DbgPrint
ExAllocatePool
ExFreePoolWithTag
IoAllocateIrp
IoCreateDevice
IoCreateDriver
IoCreateFile
IoCreateSymbolicLink
IoDriverObjectType
IoFileObjectType
IoFreeIrp
IoFreeMdl
IoGetCurrentProcess
IoGetFileObjectGenericMapping
IofCallDriver
IofCompleteRequest
KeInitializeEvent
KeSetEvent
KeStackAttachProcess
KeUnstackDetachProcess
KeWaitForSingleObject
MmBuildMdlForNonPagedPool
MmCopyVirtualMemory
MmCreateMdl
MmGetPhysicalAddress
MmGetSystemRoutineAddress
MmIsAddressValid
MmMapIoSpace
MmUnmapIoSpace
ObCreateObject
ObReferenceObjectByHandle
ObReferenceObjectByName
ObfDereferenceObject
PsGetProcessPeb
PsGetProcessWow64Process
PsLookupProcessByProcessId
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlEqualUnicodeString
RtlFreeAnsiString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
SeCreateAccessState
ZwAllocateVirtualMemory
ZwClose
ZwFreeVirtualMemory
ZwOpenProcess
ZwTerminateProcess
strcmp
strlen
wcscpy
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
llvmmsvc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ