bslfti[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bslfti.sys
Size

8KB
MD5

78728c88a7b3b3b6b9a8e2dee22b560c
SHA1

37dd9a65e587b598e8fa983fbad84fa6952bdaca
SHA256

5be6ebddd2ec51717f7c019c2cf2dc88fb56244fedd92b347378566dd7e8c9be
SHA512

601c868c19bdded9b8ddf8876c5d0cc56348a3f5724af790ed19757dc593872f6ddef900f0c4f1aef7fd7acd60bf137baceab2154c3c5a806b2ec5ad2f1f5f71
SSDEEP

96:4xgJw+f2qU2oIgYUwjE4yvo+NPI8wwwKgKT305qXz:4Si+f2v3rG5yvouAZK/hX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bslfti.sys

Files

bslfti.sys
.sys windows:10 windows x64 arch:x64

62011c15011bf3a01be401bf19c6a193

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\nicov\OneDrive\Desktop\Spoofer Source\Driver\x64\Release\Kernel.pdb

Imports

ntoskrnl.exe

IoDriverObjectType
ObReferenceObjectByName
MmCopyMemory
RtlRandomEx
RtlCopyUnicodeString
ObfDereferenceObject
ExFreePoolWithTag
ExAllocatePoolWithTag
DbgPrint

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ