dr[.]sys | Triage

Sharing

General

Target

dr.sys
Size

8KB
MD5

bafcac47203b27468dfb1caaee7ccbf5
SHA1

2d9c823fbe2ce50528849c56fe9c66058e112f27
SHA256

6d9ebda4e8582f09af264ac995b132f2d1bb9379ed58f125226495e63718354c
SHA512

86baeedf3a6ddef5141bb8cf810ca244021f766281d66ba20db160a6905f6059abdf50e2a7b98434c555db1f9ab3560767b04356cbb759fd4895f2bbdb107772
SSDEEP

192:btXEzjFZGbfs3o2szqueiCYcHpnCcznn2u/A:ZXEzhsmszRxC5JbA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dr.sys

Files

dr.sys
.sys windows:10 windows x64 arch:x64

f41e7a2bbfc71d3487eba644766e7891

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\! Saturn\PaysonDRV v3\build\DRV\Kernel.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
DbgPrint
RtlGetVersion
ExAllocatePoolWithTag
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
MmCopyMemory
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
IoCreateDriver
PsGetProcessSectionBaseAddress

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE