kbdhid.pdb
Static task
static1
1 signatures
General
-
Target
ca35e259406a5e9d8756c7df19e2e93a
-
Size
14KB
-
MD5
ca35e259406a5e9d8756c7df19e2e93a
-
SHA1
b66872f497c6f059c5180d22f5b0d16b40096f81
-
SHA256
d795bd604e9fd94bcac7d181f895174b9f0935c0909956dec47df25ab85644c1
-
SHA512
019fcf151fbabc32166727c9dace74f11d53c7b58718fee7979e8984f226225c261671bfdeb51d51c60e7df54c3b7ce8e9d5592cf9dadb46281a7deef319bfcb
-
SSDEEP
192:GNmvsuoyMBRTxkkaeb+Qa3Hk/8f2fHASVt1ewe2IQdXA4cS7QvR2q:kuoVB9xkkyz3EZoSXUbEZA4cS7ARh
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca35e259406a5e9d8756c7df19e2e93a
Files
-
ca35e259406a5e9d8756c7df19e2e93a.sys windows:5 windows x86 arch:x86
85e9e728151275af060aba017d8d73b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
memmove
KeWaitForSingleObject
IoBuildDeviceIoControlRequest
KeInitializeEvent
ZwQueryValueKey
PoSetPowerState
KeInitializeTimer
KeInitializeDpc
IoInitializeRemoveLockEx
IoDeleteDevice
IoDetachDevice
IoAllocateIrp
KeInitializeSpinLock
IoAttachDeviceToDeviceStack
IoCreateDevice
KeSetEvent
PoCallDriver
RtlInitUnicodeString
IoFreeIrp
IoReleaseRemoveLockAndWaitEx
IoCancelIrp
IoAllocateErrorLogEntry
KeCancelTimer
IoWMIRegistrationControl
KeSetTimerEx
DbgPrint
DbgBreakPointWithStatus
KdDebuggerEnabled
KeResetEvent
IoReuseIrp
_allmul
ZwOpenKey
ZwEnumerateValueKey
KeTickCount
KeBugCheckEx
ZwSetValueKey
ZwClose
IoFreeWorkItem
IoAllocateWorkItem
IoQueueWorkItem
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoFreeMdl
IoWriteErrorLogEntry
KeDelayExecutionThread
IoOpenDeviceRegistryKey
ExAllocatePoolWithTag
RtlAppendUnicodeToString
ExFreePoolWithTag
IoAcquireRemoveLockEx
IofCompleteRequest
IofCallDriver
PoStartNextPowerIrp
IoReleaseRemoveLockEx
hal
KfLowerIrql
KfRaiseIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
wmilib.sys
WmiSystemControl
WmiCompleteRequest
hidparse.sys
HidP_UnsetUsages
HidP_MaxUsageListLength
HidP_GetCaps
HidP_TranslateUsageAndPagesToI8042ScanCodes
HidP_UsageAndPageListDifference
HidP_SetUsages
HidP_GetUsagesEx
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 471B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 768B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ