D:\免费版本\暗组免费专版\PcHide\objfre\i386\vbnxqwwer.pdb
Static task
static1
General
-
Target
c70bea464ae1287f3b260ddc374f6c6a
-
Size
5KB
-
MD5
c70bea464ae1287f3b260ddc374f6c6a
-
SHA1
9c9111767ab702fbc7b768b2e77021b5d547fb63
-
SHA256
e3b870ab13a1db04c733b9c460a46fb57b8760de5fad9b613c91b902d5d2f054
-
SHA512
e85c27ab7a01a3029e41825a86edb284283cf470b04e9fbbac402e69e1d279b4aaf402160d9e1b9ff5a3a8fc15274a81a136371427ce0feb98b5b54d2bd854c9
-
SSDEEP
96:+IcoQo1FLkdF8Bt6CQJUuU5lQy6qa3MC6/:+IcoQo1FLkdFg6CQJFD3WP/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c70bea464ae1287f3b260ddc374f6c6a
Files
-
c70bea464ae1287f3b260ddc374f6c6a.sys windows:5 windows x86 arch:x86
3325a1a4fcabd2c615283d9ae29fc5b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlFreeAnsiString
RtlCompareMemory
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
PsGetCurrentProcessId
ZwQueryDirectoryFile
ZwDeviceIoControlFile
IoDeleteDevice
IoDeleteSymbolicLink
wcscat
RtlFreeUnicodeString
wcscpy
RtlAnsiStringToUnicodeString
IofCompleteRequest
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 640B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 526B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ASPack Size: 28B - Virtual size: 28B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ