C:\tmp\1\objfre\i386\1.pdb
Static task
static1
1 signatures
General
-
Target
ae2d797f1aad11e280f82e3a9e43f766
-
Size
48KB
-
MD5
ae2d797f1aad11e280f82e3a9e43f766
-
SHA1
d716ae71c95d75ffa34d256427d77c4780104e9f
-
SHA256
e6a60142b7cda6506ede4d35e98a1eca0137446926c2f998b533d36207757b1e
-
SHA512
9a50a6a09c00b9528834d2c602f2a7233a4516aba3871b62232c10c55cc6913e2ed40d9a6db6bb36210459b1066e6a4010fc5c50d5accb6191feadd3c4c0d979
-
SSDEEP
96:XbCjswPpDSDiPDmkZN2FH6OD/5kRsUff1j57EsAMZM7tMlXRvZJkxa2RpDSjb4iG:rsswRDSEH4RVkj7E/qlBzmaypDSjHk
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae2d797f1aad11e280f82e3a9e43f766
Files
-
ae2d797f1aad11e280f82e3a9e43f766.sys windows:5 windows x86 arch:x86
1d448196cab47073187d72aefbdcc33d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwClose
ZwWriteFile
ZwCreateFile
ZwDeleteFile
RtlInitUnicodeString
KeDelayExecutionThread
IofCompleteRequest
RtlEqualUnicodeString
KeServiceDescriptorTable
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
PsCreateSystemThread
IoFreeMdl
MmUnlockPages
ExFreePoolWithTag
KeInsertQueueApc
KeInitializeApc
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
MmProbeAndLockPages
IoAllocateMdl
ExAllocatePoolWithTag
_strnicmp
IoGetCurrentProcess
_except_handler3
Sections
.text Size: 896B - Virtual size: 884B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 287B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 768B - Virtual size: 734B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 230B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ