usb80236.pdb
Static task
static1
Behavioral task
behavioral1
Sample
usb80236.sys
Resource
win10v2004-20240709-en
General
-
Target
usb80236.sys
-
Size
23KB
-
MD5
5c27ec614abdd771c05c907268e42734
-
SHA1
8192289ae94ec0fa29420309bff3ff2d993431c4
-
SHA256
db298d4d4ec236ae141ee050f236f11fc603f55fb1b3392286ac81cef2bb8039
-
SHA512
e832cd93cd35ae99840a5c9ace03cb125fab7383a83eb599bdbd4b7e80b66d791e156c6033cdcc0e7b1f77203472ced7a25b68390f9b094391e8bd8faf483abb
-
SSDEEP
384:9ULiRdqwQa8+YYT1BvJ/LMsS5J4VPd+7s6ezz8iQ1xuBsoNCzDGDsKFKUSL5XE2z:XdqZa8CRJi5KVPd+7s6gRiDGDrKUpRhZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource usb80236.sys
Files
-
usb80236.sys.sys windows:10 windows x64 arch:x64
bd524fd3d825fb5e201a11657bd50d91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
KeReleaseSpinLock
KeSetEvent
IoFreeWorkItem
KeInitializeEvent
IoQueueWorkItem
IoCancelIrp
KeWaitForMultipleObjects
KeLowerIrql
ExFreePool
IoAllocateIrp
IofCallDriver
KfRaiseIrql
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeInitializeTimer
IoFreeMdl
KeReleaseSpinLockFromDpcLevel
KeCancelTimer
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
ExAllocatePoolWithTag
KeQueryTimeIncrement
IoAllocateWorkItem
IoFreeIrp
KeAcquireSpinLockAtDpcLevel
KeInitializeDpc
KeSetTimer
IoAllocateMdl
KeInitializeSpinLock
usbd.sys
USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
rndismp6.sys
RndisMSendCompleteEx
RndisMInitializeWrapperEx
RndisMIndicateReceiveEx
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 756B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 512B - Virtual size: 354B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GFIDS Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ