C:\Users\Jojo0604\Desktop\kernel\x64\Release\kernel.pdb
Static task
static1
1 signatures
General
-
Target
a7d7918287e20b0dba642c291b6e7efc6e73222cf5ed02254926b898c9107d5f.exe
-
Size
10KB
-
MD5
2e7f3482c7ffd78c5cc18f12c3cb0d67
-
SHA1
259c139776ea45c887dd8ab4cae3b169d9414096
-
SHA256
a7d7918287e20b0dba642c291b6e7efc6e73222cf5ed02254926b898c9107d5f
-
SHA512
e8bdd2bfed1e8b8fa70d63d5666669cbc72265f37232a73c36ec6e9ad0803e0aacdb6e65ab3e97d4c1f2a440a1271c6940f6437e959b646f6c3f2196bba44931
-
SSDEEP
192:uP6Y/pOWH2idc3KbLWF4GYcO6AOeD6Jf:uP/9c6OuG5O6+6J
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7d7918287e20b0dba642c291b6e7efc6e73222cf5ed02254926b898c9107d5f.exe
Files
-
a7d7918287e20b0dba642c291b6e7efc6e73222cf5ed02254926b898c9107d5f.exe.sys windows:10 windows x64 arch:x64
a70a3819f8d617b6088df0625740b273
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
IoGetCurrentProcess
ObfDereferenceObject
KeAttachProcess
KeDetachProcess
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
MmCopyVirtualMemory
PsGetProcessSectionBaseAddress
ZwProtectVirtualMemory
MmHighestUserAddress
DbgPrintEx
ExAllocatePool
ExFreePoolWithTag
IofCompleteRequest
ZwClose
ZwOpenKey
ZwQueryValueKey
RtlRandomEx
ObReferenceObjectByName
IoDriverObjectType
RtlInitUnicodeString
RtlCompareUnicodeString
RtlGetVersion
MmUnmapIoSpace
MmMapIoSpaceEx
ZwSetValueKey
MmCopyMemory
PsGetProcessPeb
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 61B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ