f:\winddk\demo\_netbot\i386\RiSing.pdb
Static task
static1
1 signatures
General
-
Target
c74c14d09e7ab8bd320810362bfefe5f
-
Size
4KB
-
MD5
c74c14d09e7ab8bd320810362bfefe5f
-
SHA1
4685519f545e18fe8d58f81101be7aea547160c8
-
SHA256
f2d5744de27fe8db27cd87312faa98f1345adabca2e142f58acf8b47acba2cd6
-
SHA512
eec61d2b5da8d58c99f9e96f8c979b32ead9a23c67ac12b97e0e45bad6e676afe2f204c1e79baab9d3023fc19a653bee3330191f1097959028e1183aac87d910
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c74c14d09e7ab8bd320810362bfefe5f
Files
-
c74c14d09e7ab8bd320810362bfefe5f.sys windows:6 windows x86 arch:x86
dec7a2a7d7e5766d37afb9a2633ae117
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
IofCompleteRequest
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
RtlUnwind
KeBugCheckEx
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 414B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ