e:\source\nsoft\driver\objfre_wxp_x86\i386\drive4.pdb
Static task
static1
1 signatures
General
-
Target
c040375cecd247d4808a5c5bf3dd1962
-
Size
29KB
-
MD5
c040375cecd247d4808a5c5bf3dd1962
-
SHA1
6348efebcadc350b0a045a6b3921a3597d3cee3e
-
SHA256
7e217b0890474b2a7c64a609d8fbd05e7263222c11b68cda8bd8f5e026f00004
-
SHA512
a17f085f9e01edb4f75963a8382abc6ca662208b03f0f15c8bbbfdcd35ab4042b1b2b25456fd7a659ab2d6203cd6af9cfe32b982af4ea42d4acfa7510e5c6257
-
SSDEEP
768:onr7n4osxct1h3s6kKPts/KTtzdQRHoBGiOIl:ertsxawGts/KTFGRHo7l
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c040375cecd247d4808a5c5bf3dd1962
Files
-
c040375cecd247d4808a5c5bf3dd1962.sys windows:6 windows x86 arch:x86
08d835a56af436c3e1d75355e82f7929
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
NtBuildNumber
RtlInitUnicodeString
wcsncpy
memset
IofCompleteRequest
ExFreePoolWithTag
ZwClose
ZwWriteFile
ZwCreateFile
ExAllocatePool
_except_handler3
memcpy
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ZwQuerySystemInformation
ObReferenceObjectByHandle
ZwOpenThread
ObfReferenceObject
PsLookupProcessByProcessId
ObfDereferenceObject
IoFreeMdl
KeInsertQueueApc
KeInitializeApc
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
MmProbeAndLockPages
wcsncmp
ObOpenObjectByName
wcsstr
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
ZwQueryDirectoryObject
ZwOpenDirectoryObject
KeReleaseMutex
KeWaitForSingleObject
ExAllocatePoolWithTag
MmIsAddressValid
IoRegisterFsRegistrationChange
KeInitializeMutex
ProbeForRead
RtlImageDirectoryEntryToData
strstr
ObQueryNameString
KeServiceDescriptorTable
wcsncat
ZwDeleteValueKey
ZwSetValueKey
ZwEnumerateValueKey
ZwEnumerateKey
ZwOpenKey
ZwQueryDirectoryFile
ZwOpenFile
ZwOpenProcess
IoAllocateMdl
hal
KfLowerIrql
KfRaiseIrql
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 896B - Virtual size: 834B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ