d:\程序\kill\Driver\i386\KILLPRC.pdb
Static task
static1
General
-
Target
ca62fdbf77c88a6b4feacc561d73e9c0N
-
Size
3KB
-
MD5
ca62fdbf77c88a6b4feacc561d73e9c0
-
SHA1
c3db82e6a2057ebf9e847e620de21419d8960d47
-
SHA256
2bac2453d6b08d672e28b70dc5056eb83e77f6a32bd4271241bbce35a587fc3a
-
SHA512
b6cc6c86dbc70cb89a1d679934d13a7e2038854c172e242e8481cbd37a02d8dfeed63eb7c15f18b2cf4cae5583205fc5bef93f3805b7398c3f4c15a96d1391e3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca62fdbf77c88a6b4feacc561d73e9c0N
Files
-
ca62fdbf77c88a6b4feacc561d73e9c0N.sys windows:6 windows x86 arch:x86
e833bd1df48442a94c2758b0ea9fd9ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ObfDereferenceObject
ObOpenObjectByPointer
MmGetSystemRoutineAddress
RtlInitUnicodeString
PsLookupProcessByProcessId
ZwClose
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 155B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 640B - Virtual size: 542B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 768B - Virtual size: 680B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ