G:\vcprj\PlugXP\Rootkit\i386\agony.pdb
Static task
static1
1 signatures
General
-
Target
b730525f69383d359dee6425154b3822
-
Size
191KB
-
MD5
b730525f69383d359dee6425154b3822
-
SHA1
b5ec30280f448f571aee47e0424e2a0d078fc88f
-
SHA256
cab7fb5d80ee5cb837d7ff2dce9ce97eb3d9ebe77fd1ceb15d894e62855da768
-
SHA512
ab4e55412350995022b776cee48a892e700c1259bb2e0f052e45ee6e1bf0294875e2ee8a233ad4011f7c401cba76c21bb9764e7a8f55b83c300bb6cf486508a0
-
SSDEEP
3072:lgQG2d8Hv6DLbvDGWSsQ4c3lL9UvS+Aml4TlRXS+hE2PZnzZWnWDM2xednV4iT:lg9nw7h/0h9UqRXS+hE2PZMWDM2xed
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b730525f69383d359dee6425154b3822
Files
-
b730525f69383d359dee6425154b3822.sys windows:5 windows x86 arch:x86
7083b7f53358c431a9238cf234409f78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwEnumerateValueKey
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwClose
RtlInitUnicodeString
ObReferenceObjectByHandle
ZwOpenProcess
ZwQuerySystemInformation
_strnicmp
MmIsAddressValid
KeDetachProcess
MmHighestUserAddress
ZwQueryInformationProcess
DbgPrint
swprintf
strncmp
IoGetCurrentProcess
KeDelayExecutionThread
ZwDeleteValueKey
ZwOpenKey
ZwSetValueKey
MmGetSystemRoutineAddress
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoFreeMdl
MmUnmapLockedPages
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
ZwQueryDirectoryFile
_stricmp
IoRegisterDriverReinitialization
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoCreateSymbolicLink
ZwEnumerateKey
KeAttachProcess
wcslen
hal
KfRaiseIrql
KeGetCurrentIrql
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 267B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ