Static task
static1
Behavioral task
behavioral1
Sample
driver.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
driver.sys
Resource
win10-20240404-en
General
-
Target
driver.sys
-
Size
3KB
-
MD5
4961ad28f366ddb4faec6b50dd93d332
-
SHA1
de2b49487c3e611ca924af9d9ed9faca13064896
-
SHA256
4a8628752da375b1cd440f173dbf750fad9506c31238f5e60ac8b5d41a49ccd4
-
SHA512
f23e92ebd15a5e8768c5dc5761cf3181ab5b95d3f05cd072e6b9cb8ae45bc0e1fcc7874d91443a86ef363b678a864b2cfc67e0f9703f0d2e55895bd84c8d2000
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource driver.sys
Files
-
driver.sys.sys windows:1 windows x64 arch:x64
d9c9c4541168665f44917e3ddc4a00d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
DbgPrint
Sections
.text Size: 512B - Virtual size: 39B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 38B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 512B - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE