csrss.pdb
Static task
static1
General
-
Target
executable.596.exe
-
Size
6KB
-
MD5
8a072271595903787c24091e49fca046
-
SHA1
d963e55eda3d52c62ba9cace369d925cb8197def
-
SHA256
f920fe90f3675a1de3896a275182707553883e41531b7dc301f09537aab66c6b
-
SHA512
a812a52c5d597cf654ab58d3b712fab49fc962efcfee5391c16a7ff87438a1d5f00949a85812a1b4d374b916241a9ddcff57ea3bb25069163a15a4a2962ff89d
-
SSDEEP
96:1jd6AN1CnotgbZm4vU/93SqYs5xEW5RtnWwG:1jd6ANooygp/ZSq/5yW5RtnW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource executable.596.exe
Files
-
executable.596.exe.sys windows:5 windows x86 arch:x86
083b2fda79bfff27730cc9cc50f8ecd5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntdll
NtTerminateProcess
NtRaiseHardError
NtTerminateThread
RtlUnwind
NtQueryVirtualMemory
RtlSetProcessIsCritical
NtSetInformationProcess
DbgBreakPoint
RtlAllocateHeap
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
csrsrv
CsrServerInitialization
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ