c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb
Static task
static1
1 signatures
General
-
Target
9da15be14ff7e1e78ff6d67649268a3d9fd117a04393f9ff972326ddd887257cN
-
Size
27KB
-
MD5
a501f17fce548f2ba780c3576c5fe5e0
-
SHA1
2a4f6f43ebfc219f5e353f1634d4c38afa043a80
-
SHA256
9da15be14ff7e1e78ff6d67649268a3d9fd117a04393f9ff972326ddd887257c
-
SHA512
bb1659fbe03b2a83e1372329aaa01dc79f50c4371c1b3b20254778d4696fb329f6e801e164832a3a367831b4aa9005272a138feab3db8e9ac9daf6a5ae0bb3e8
-
SSDEEP
384:63YUY30d1Kgf4AtcTmwZ/22a97C5ohYh3IB96Oys2+l0skiM0HMFrba8no0ceD/4:6OUkgfdZ9pRyv+uPzCMHo3q4tDghm
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9da15be14ff7e1e78ff6d67649268a3d9fd117a04393f9ff972326ddd887257cN
Files
-
9da15be14ff7e1e78ff6d67649268a3d9fd117a04393f9ff972326ddd887257cN.sys windows:6 windows x64 arch:x64
17fec1f996adceb4112879eb84986897
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
ExFreePoolWithTag
KeBugCheckEx
_wcsicmp
ZwQuerySystemInformation
ExAllocatePool
ZwClose
ZwOpenProcess
ObfDereferenceObject
ZwTerminateProcess
ObOpenObjectByName
ZwOpenDirectoryObject
ObQueryNameString
IoDriverObjectType
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
ZwQueryDirectoryObject
MmIsAddressValid
KeResetEvent
KeInitializeApc
KeSetEvent
KeInsertQueueApc
KeInitializeEvent
KeWaitForSingleObject
RtlCaptureStackBackTrace
PsGetCurrentThreadId
PsLookupThreadByThreadId
ExAllocatePoolWithTag
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IoGetAttachedDevice
IoGetRelatedDeviceObject
IoCreateFile
IoFileObjectType
IoFreeIrp
IoAllocateIrp
IofCallDriver
RtlGetVersion
PsGetVersion
__C_specific_handler
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 512B - Virtual size: 108B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 150B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ