G:\vcprj\PlugXP\Rootkit\i386\agony.pdb
Static task
static1
1 signatures
General
-
Target
be99fa864a5d805cf618d75322f2676e
-
Size
191KB
-
MD5
be99fa864a5d805cf618d75322f2676e
-
SHA1
11f0b8ca75b775eea8a150e8dab48d06f380bf37
-
SHA256
eafbf1430967595228882f75442b96647e6ab7222d92e6123c8f94694c952d3f
-
SHA512
091679a5c23a5143cb3d4be861abc0ad82b7a2ebfbdbc3b45cb325f7f33a8a629270d5f6b8419d12e94670014c646f9bcba1fe480fc73fdc40b1ed1a2431b0a5
-
SSDEEP
3072:xgQG2d8Hv6DLbvDGWSsQ4c3lL9UvS+Aml4TlRXS+hE2PZnzZWnWDM2xednV4i5:xg9nw7h/0h9UqRXS+hE2PZMWDM2xed
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be99fa864a5d805cf618d75322f2676e
Files
-
be99fa864a5d805cf618d75322f2676e.sys windows:5 windows x86 arch:x86
7083b7f53358c431a9238cf234409f78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwEnumerateValueKey
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwClose
RtlInitUnicodeString
ObReferenceObjectByHandle
ZwOpenProcess
ZwQuerySystemInformation
_strnicmp
MmIsAddressValid
KeDetachProcess
MmHighestUserAddress
ZwQueryInformationProcess
DbgPrint
swprintf
strncmp
IoGetCurrentProcess
KeDelayExecutionThread
ZwDeleteValueKey
ZwOpenKey
ZwSetValueKey
MmGetSystemRoutineAddress
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoFreeMdl
MmUnmapLockedPages
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
ZwQueryDirectoryFile
_stricmp
IoRegisterDriverReinitialization
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoCreateSymbolicLink
ZwEnumerateKey
KeAttachProcess
wcslen
hal
KfRaiseIrql
KeGetCurrentIrql
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 267B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ