F:\sysfors\objfre_w2k\i386\live.pdb
Static task
static1
1 signatures
General
-
Target
cbc299f235ad1567c2fdaba11df54d84
-
Size
11KB
-
MD5
cbc299f235ad1567c2fdaba11df54d84
-
SHA1
7f03f7c7601e83b7de0b682adf9df976e96f470f
-
SHA256
3c2f7ac0fb060aeae3215f189977d57a589f4d1ed99c022bf47cfc55411b3418
-
SHA512
75907fff75b2b65fdf4f3010485ebb5d384e2921d6475ab9d3ef1f7c712b372b80830a0799034e7cc91dfbe47b0f419239e9ccd238447d5d5f731833f8a31663
-
SSDEEP
192:NUHVMP92ZzWOFKgux+tzIezEWUahCkr/ZDmss4/Iad:yHVMPQZzcvx+t+iCkNDmsv/
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cbc299f235ad1567c2fdaba11df54d84
Files
-
cbc299f235ad1567c2fdaba11df54d84.sys windows:5 windows x86 arch:x86
18e74cd9b722c97e921d5a9c36578080
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwCreateFile
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwCreateKey
KeServiceDescriptorTable
RtlInitUnicodeString
RtlCompareMemory
IofCompleteRequest
IoRegisterDriverReinitialization
RtlFreeAnsiString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
swprintf
mbstowcs
IoCreateSymbolicLink
IoCreateDevice
wcscat
_strlwr
RtlUnicodeStringToAnsiString
wcsrchr
_wcslwr
ZwEnumerateKey
ZwOpenKey
ExFreePool
ExAllocatePoolWithTag
ZwOpenFile
strncmp
IoGetCurrentProcess
PsTerminateSystemThread
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
sprintf
_stricmp
strncpy
PsLookupProcessByProcessId
KeDelayExecutionThread
wcslen
_snprintf
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
MmIsAddressValid
ZwUnmapViewOfSection
_except_handler3
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 768B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ