kbdhid.pdb
Static task
static1
1 signatures
General
-
Target
c7ee64acbf20eaf738a04981c8dd5ce9
-
Size
14KB
-
MD5
c7ee64acbf20eaf738a04981c8dd5ce9
-
SHA1
f1cac7022ce99696d46ea49b965688e67ed7cf82
-
SHA256
3b70f83c3550df67610d8942747612c22ff15e0e57cf7489d75f1a5f92e8c5b2
-
SHA512
6462d7c80337293fe13ccf17df4ef89ac0b628873a44ca577cf2530fd32f2960260124450fd89cdce60161a3d1d0c3a58ede38017686296b247149f44bf5ea46
-
SSDEEP
192:/NmvsuoyMBRTxkkaeb+Qa3Hk/8f2fHASVt1ewe2IQdXA4xk727QvR2q:duoVB9xkkyz3EZoSXUbEZA4I27ARh
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7ee64acbf20eaf738a04981c8dd5ce9
Files
-
c7ee64acbf20eaf738a04981c8dd5ce9.sys windows:5 windows x86 arch:x86
85e9e728151275af060aba017d8d73b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
memmove
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
ZwQueryValueKey
PoSetPowerState
KeInitializeTimer
KeInitializeDpc
IoInitializeRemoveLockEx
IoDeleteDevice
IoDetachDevice
IoAllocateIrp
KeInitializeSpinLock
IoAttachDeviceToDeviceStack
IoCreateDevice
KeSetEvent
PoCallDriver
RtlInitUnicodeString
IoFreeIrp
IoReleaseRemoveLockAndWaitEx
IoCancelIrp
IoAllocateErrorLogEntry
KeCancelTimer
IoWMIRegistrationControl
KeSetTimerEx
DbgPrint
DbgBreakPointWithStatus
KdDebuggerEnabled
KeResetEvent
IoReuseIrp
_allmul
ZwOpenKey
ZwEnumerateValueKey
KeTickCount
KeBugCheckEx
ZwSetValueKey
ZwClose
IoFreeWorkItem
IoAllocateWorkItem
IoQueueWorkItem
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
IoWriteErrorLogEntry
KeDelayExecutionThread
IoOpenDeviceRegistryKey
ExAllocatePoolWithTag
RtlAppendUnicodeToString
ExFreePoolWithTag
IoAcquireRemoveLockEx
IofCompleteRequest
IofCallDriver
PoStartNextPowerIrp
IoReleaseRemoveLockEx
hal
KfLowerIrql
KfRaiseIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
wmilib.sys
WmiSystemControl
WmiCompleteRequest
hidparse.sys
HidP_UnsetUsages
HidP_MaxUsageListLength
HidP_GetCaps
HidP_TranslateUsageAndPagesToI8042ScanCodes
HidP_UsageAndPageListDifference
HidP_SetUsages
HidP_GetUsagesEx
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 471B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 768B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ