E:\练习代码\SYS练习\hosts\Checked\EmptyDriver.pdb
Static task
static1
1 signatures
General
-
Target
c30c99f8757025ba03db5f110b7b4bb8
-
Size
28KB
-
MD5
c30c99f8757025ba03db5f110b7b4bb8
-
SHA1
41c8c3f17040379dd6281298ab4637738e6b02fe
-
SHA256
3f3c6d27c98b70eefac90018efdb7a24cc115c152ecd9fc86171f7298a94d544
-
SHA512
8d1d097510bfaa568941800740ee52e39a909c89a5c2ce98b9cd024beaf832f5775b431685b2af299fef586a666ff951fb5b64cbd3b2d96de7f2542fb88e5b29
-
SSDEEP
384:OtDN3sFUOQlQFuUMOMkWpjFXyy6owHYvorDKSC6xanJ2b0tV15m2WOZv1aWiLao:OP3s7P5KxArDKSCVYAvNa9a
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c30c99f8757025ba03db5f110b7b4bb8
Files
-
c30c99f8757025ba03db5f110b7b4bb8.sys windows:5 windows x86 arch:x86
253f859cbef2b828df05d02a02dda110
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
DbgPrint
IoCreateDevice
RtlInitUnicodeString
IoDeleteSymbolicLink
KeDelayExecutionThread
_allmul
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
MmGetSystemRoutineAddress
ZwOpenProcess
ObOpenObjectByPointer
PsProcessType
ZwClose
ZwWriteFile
ZwCreateFile
ZwDeleteFile
ExFreePoolWithTag
ZwReadFile
ExAllocatePool
ZwQueryInformationFile
RtlCompareString
RtlInitString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
KeServiceDescriptorTable
IoCreateSymbolicLink
memset
RtlFreeUnicodeString
RtlCopyUnicodeString
RtlCompareUnicodeString
PsLookupProcessByProcessId
ZwQuerySystemInformation
PsTerminateSystemThread
KeInsertQueueApc
KeInitializeApc
MmIsAddressValid
IoThreadToProcess
PsLookupThreadByThreadId
ZwSetValueKey
ZwCreateKey
ZwDeleteKey
IoGetCurrentProcess
KeInsertQueueDpc
KeSetTargetProcessorDpc
KeInitializeDpc
ExAllocatePoolWithTag
IofCompleteRequest
RtlAnsiStringToUnicodeString
RtlInitAnsiString
IoCheckShareAccess
RtlCompareMemory
PsCreateSystemThread
IoDeleteDevice
PsGetVersion
RtlAssert
hal
KeRaiseIrqlToDpcLevel
KfLowerIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ