h:\workshopagent\developproj2\tsandbox\trunk\tsandbox\tsandboxdrv\tsandboxdrv\objfre_win7_x86\i386\TSandboxDrv7.pdb
Static task
static1
General
-
Target
a4e7752001ebbf8e075ce7704804873c20d53272cb3de99f2ffd5500aeb95d75
-
Size
305KB
-
MD5
7d591a7b6d86fe05fdc6796bd8369dfd
-
SHA1
7495aecd86f622241de9c41d10e8c996f92f9b89
-
SHA256
a4e7752001ebbf8e075ce7704804873c20d53272cb3de99f2ffd5500aeb95d75
-
SHA512
8ef6e31d9fc1c6a476921883e936e257cfa43f315651da20458350e33cdec40105c2837f8b5667ffa1b8111b7e8c00adad514bc32bf5986c7e664dede95f5ab5
-
SSDEEP
6144:9DgoClPb68VqzBrlCAHfWn3qTZo9eq+QIQZ6Y7aJ58T+NTlv:98oCljIdpCAHfW3EoIQZ6iaZF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4e7752001ebbf8e075ce7704804873c20d53272cb3de99f2ffd5500aeb95d75
Files
-
a4e7752001ebbf8e075ce7704804873c20d53272cb3de99f2ffd5500aeb95d75.sys windows:6 windows x86 arch:x86
d0ad985d1bea961dde9e4c22f114b1ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
DbgPrint
PsGetCurrentProcessId
PsGetCurrentThreadId
RtlVolumeDeviceToDosName
ObfReferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
memcpy
memset
MmGetSystemRoutineAddress
RtlGetVersion
IoDeleteDevice
IoCreateSymbolicLink
swprintf
ExInitializeNPagedLookasideList
ExInitializeResourceLite
ExDeleteResourceLite
ExDeleteNPagedLookasideList
PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx
CmRegisterCallback
IoRegisterFsRegistrationChange
ExAllocatePoolWithTag
IoDetachDevice
ZwCreateDirectoryObject
wcschr
ProbeForRead
MmIsAddressValid
wcsncpy
IofCallDriver
KeSetEvent
KeWaitForSingleObject
IofCompleteRequest
MmMapLockedPages
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoAttachDeviceToDeviceStack
IoBuildDeviceIoControlRequest
RtlEqualUnicodeString
ObQueryNameString
KeDelayExecutionThread
IoGetDeviceAttachmentBaseRef
RtlCopyUnicodeString
IoCreateDevice
RtlCompareUnicodeString
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
IoFileObjectType
ObReferenceObjectByHandle
sprintf
KeQuerySystemTime
wcsncat
ZwFlushBuffersFile
ZwWriteFile
ZwReadFile
_wcsnicmp
IoCreateFile
_wcsicmp
RtlAppendUnicodeStringToString
memmove
IoCancelFileOpen
KeTickCount
FsRtlInsertPerStreamContext
wcsncpy_s
FsRtlLookupPerStreamContextInternal
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
_stricmp
ObfDereferenceObject
ZwEnumerateKey
ZwEnumerateValueKey
_alldiv
_allmul
ZwQueryKey
wcsrchr
ZwQueryValueKey
ZwSetValueKey
ZwDeleteValueKey
ZwCreateKey
RtlFreeUnicodeString
ObOpenObjectByPointer
ZwQuerySecurityObject
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
ZwDeleteKey
wcsncmp
RtlUnicodeStringToInteger
strncmp
IoGetCurrentProcess
strncpy
PsLookupProcessByProcessId
RtlConvertSidToUnicodeString
NtQueryInformationToken
ZwOpenProcessTokenEx
PsProcessType
IoCreateNotificationEvent
InterlockedPopEntrySList
InterlockedPushEntrySList
KeGetCurrentThread
IoFreeIrp
IoFreeMdl
MmUnlockPages
IoAllocateIrp
IoCreateStreamFileObjectLite
IoSetTopLevelIrp
IoGetTopLevelIrp
IoCreateFileSpecifyDeviceObjectHint
IoQueryFileDosDeviceName
_wcslwr
ZwOpenEvent
KeResetEvent
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
RtlTimeToTimeFields
ExSystemTimeToLocalTime
vsprintf
ExInitializePagedLookasideList
ExDeletePagedLookasideList
MmMapLockedPagesSpecifyCache
_strnicmp
_strlwr
PsTerminateSystemThread
KeSetPriorityThread
PsThreadType
PsCreateSystemThread
KeBugCheckEx
RtlUnwind
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ExAllocatePool
ExFreePoolWithTag
ZwClose
ZwOpenKey
KeInitializeEvent
ZwSetSecurityObject
IoDeviceObjectType
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAddAccessAllowedAce
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
hal
KeQueryPerformanceCounter
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
Sections
.text Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ