d:\young\httprdr\tdxflt\objfre_wxp_x86\i386\TdxFlt_i386.pdb
Static task
static1
1 signatures
General
-
Target
87d49bf377ea8f61218b2afe85ab02a541dff4d860c5e80299c1e065af66d689
-
Size
108KB
-
MD5
65fa2cf15cf83d2eeb2fd5d64ae0fe43
-
SHA1
bcd4b6e32ddd4189a08360528120c48b209981c7
-
SHA256
87d49bf377ea8f61218b2afe85ab02a541dff4d860c5e80299c1e065af66d689
-
SHA512
bc6922d8e504b6b026860c6c00662e422e3b81334b6b25ec5ba5a4145c47893e2bde9514bd193e40f3b3d27415cafbb4e1e7bb107d7928f8df9edf82e4d08b0d
-
SSDEEP
3072:9PFRFpCf4xTs1X0H2teSCQDwbkkJ7zYgBLL9v8S+e:FFRFb2X0JSCQDwbkkJ78gBLL9v8S+
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87d49bf377ea8f61218b2afe85ab02a541dff4d860c5e80299c1e065af66d689
Files
-
87d49bf377ea8f61218b2afe85ab02a541dff4d860c5e80299c1e065af66d689.sys windows:6 windows x86 arch:x86
b9d3b36e9ac30ab867495387572263e6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
ZwCreateFile
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDevice
memset
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
IofCompleteRequest
IoCancelIrp
KeQueryTimeIncrement
KeTickCount
_alldiv
_allmul
ZwFlushKey
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
memcpy
IoDeleteDevice
IoGetDeviceObjectPointer
IoCreateDevice
ZwDeleteKey
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlLargeIntegerDivide
ExSystemTimeToLocalTime
KeQuerySystemTime
_allrem
rand
srand
RtlGetVersion
RtlRandomEx
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAllocatePool
ExAllocatePoolWithTag
IoDetachDevice
PsGetCurrentProcessId
RtlCompareMemory
MmIsAddressValid
ProbeForWrite
ProbeForRead
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
memmove
_snprintf
strncpy
PsGetCurrentThreadId
ZwEnumerateKey
DbgPrint
strstr
_strnicmp
ZwDeleteFile
IoBuildSynchronousFsdRequest
RtlCompareUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwReadFile
ZwWaitForSingleObject
ZwQueryInformationFile
IoCreateFileSpecifyDeviceObjectHint
IoGetDeviceAttachmentBaseRef
ZwOpenFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
ObQueryNameString
swprintf
ZwDeviceIoControlFile
ZwFsControlFile
KeGetCurrentThread
RtlCopyUnicodeString
IoAttachDeviceToDeviceStackSafe
PsCreateSystemThread
PsTerminateSystemThread
KeSetTimerEx
KeSetPriorityThread
KeCancelTimer
KeInitializeTimerEx
KeBugCheckEx
KeInitializeEvent
ObfDereferenceObject
KeWaitForSingleObject
ZwClose
RtlInitUnicodeString
ExFreePoolWithTag
KeSetEvent
RtlAnsiCharToUnicodeChar
RtlUnwind
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
Sections
.text Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ