driver[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

driver.sys
Size

28KB
MD5

0cf55c973797d349a163467ef6ecaa3a
SHA1

8b9c194826bc202c677c5e8657cf5d5d424d5098
SHA256

c40f7d12814f71aefe6e55c79ffe894b1d31c4a280d46fdf9b4c3b85c771acbc
SHA512

b24a42ac7ed90a886696984895f73033d6a255ae8a8dce14e24d2838bfe6a4814d29fc249fabd16fd21a817bdd7372011606e142ea6d49dd36699b85e6db24fe
SSDEEP

384:yWH+uZjw5RlccAZAcMnyOsssV44tykUw9vNa8shgAllWNSxKyN52kEzx5W4F5NJg:yc+ltAZysss3HYskMyN52bTvYp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
driver.sys

Files

driver.sys
.sys windows:10 windows x64 arch:x64

66742b39ed135cbb69cf3c7002dffde1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\nickd\OneDrive\Desktop\bbbbb\c++\KMDF Driver1\x64\Release\KMDFDriver1.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
DbgPrintEx
RtlGetVersion
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
MmCopyMemory
PsLookupProcessByProcessId
IoCreateDriver
PsGetProcessSectionBaseAddress

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ