C:\Research\Driver\PROJECTS\Public\FUTo\exe\i386\msdirectx.pdb
Static task
static1
General
-
Target
d5b8f1e1de1d39d1c7183ca2f1e60f37
-
Size
62KB
-
MD5
d5b8f1e1de1d39d1c7183ca2f1e60f37
-
SHA1
48de8b05135c9a06c199f49a4bb1847d5951eed2
-
SHA256
dd5ae4141cc00f120ff1388c3c385b2abcf406986412de3ea089077b39c5c51e
-
SHA512
6096928faf3e33049c499d675d567b6c682a4292eb2e4afb5d77b9afdae8908712a758265b32b44c934cb89a43abc4402b69d4bb5b67d66eceb013dae4c4f23f
-
SSDEEP
384:8EjdQW6fARZ3voZuOGCBCzbyG6LAjDx11l11yHTjDGosSzY5uP0g7a18X2BWhc3c:8iCBfof5CQZtjl11l11vwGhrhqN0y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5b8f1e1de1d39d1c7183ca2f1e60f37
Files
-
d5b8f1e1de1d39d1c7183ca2f1e60f37.sys windows:5 windows x86 arch:x86
715c6eb6bc57320524deb970466e762b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
atoi
RtlFreeAnsiString
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
_strnicmp
ExFreePoolWithTag
ObfDereferenceObject
RtlCompareUnicodeString
ObQueryNameString
RtlAnsiStringToUnicodeString
ZwClose
ObReferenceObjectByHandle
ObOpenObjectByName
RtlInitAnsiString
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
IofCompleteRequest
IoCreateSymbolicLink
DbgPrint
IoCreateDevice
IoGetCurrentProcess
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 712B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ