D:\zzz\objfre_w2K_x86\i386\zzz.pdb
Static task
static1
1 signatures
General
-
Target
c23c7dc14af4de43c8040b0996619252
-
Size
10KB
-
MD5
c23c7dc14af4de43c8040b0996619252
-
SHA1
6f56079b2ccacd2a39a0a38758c55bf562ffc0ab
-
SHA256
d2948cdffd94fd3b97ee4316c422a1d7fd90dfcbad0029a8b6c10422427ef774
-
SHA512
32f89668e236a66f2210a3c32b01d2059a0733ccc5f7426cef7c0feec1ccb465dc0903471dfecbaf4c5ee88a59c10b5c5e5c6bdadc619798674c4793ea7eccd7
-
SSDEEP
192:BB9B5J58t3cZIojHwS6H3stf0mbf5SD8Vr6GNNZ7m47YBtjp5kpyvhy00u:BB9B5J58eZIo0s+8xSD8Vr/a47mp5kpE
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c23c7dc14af4de43c8040b0996619252
Files
-
c23c7dc14af4de43c8040b0996619252.sys windows:5 windows x86 arch:x86
2bab89b64be86afecb6e6ba415f1f98e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeSetEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlInitUnicodeString
IoGetConfigurationInformation
IoGetDeviceObjectPointer
IoFreeIrp
IoFreeMdl
MmUnlockPages
IofCallDriver
KeGetCurrentThread
MmProbeAndLockPages
ExFreePool
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
ExAllocatePoolWithTag
_except_handler3
KeWaitForSingleObject
ZwClose
IoDeleteSymbolicLink
IofCompleteRequest
ExfInterlockedInsertTailList
_alldiv
_allshl
_allshr
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ZwMakeTemporaryObject
ZwCreateDirectoryObject
ObfDereferenceObject
IoDeleteDevice
hal
KeGetCurrentIrql
KeStallExecutionProcessor
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ