e:\passthru\siglow\driver\objfre_wxp_x86\i386\vmware.pdb
Static task
static1
1 signatures
General
-
Target
facb5352c679aa73331430a0179a38a1e42e8162de77d638371c214ff93927f9N
-
Size
14KB
-
MD5
1e3fbcf9d0c432f3bcf08c0da77f77c0
-
SHA1
64fe83986c944e9a5470cc72f0fca43e2d940f71
-
SHA256
facb5352c679aa73331430a0179a38a1e42e8162de77d638371c214ff93927f9
-
SHA512
af1abd84513a7f91f25c091868d97a554f66bcfb9586341e1ee49983fca1bd524a4b2c3a26756598e384e1f2c4bcc21d45d506c76fa5bbe91d541579a28ca1c8
-
SSDEEP
192:eu5QsmSHlwZSvOV4vq7PUcVUoL9e35MCCUPGTnEIGQsw+T:eaQsmIe8mIeP19oMCsgV
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource facb5352c679aa73331430a0179a38a1e42e8162de77d638371c214ff93927f9N
Files
-
facb5352c679aa73331430a0179a38a1e42e8162de77d638371c214ff93927f9N.sys windows:6 windows x86 arch:x86
112a10e87ff78316cc01d256069fa8a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeTickCount
IofCompleteRequest
RtlInitUnicodeString
memset
memcpy
MmMapLockedPagesSpecifyCache
strstr
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisReEnumerateProtocolBindings
NdisIMDeInitializeDeviceInstance
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisIMCancelInitializeDeviceInstance
NdisIMNotifyPnPEvent
NdisQueryPendingIOCount
NdisCloseAdapter
NdisSetEvent
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisIMGetCurrentPacketStack
NdisRequest
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisReturnPackets
NdisGetPoolFromPacket
NdisCancelSendPackets
NdisFreePacketPool
NdisFreeMemory
NdisAllocateMemory
NdisWaitEvent
NdisResetEvent
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisMSleep
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
NdisDprFreePacket
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 349B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 634B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ