d:\young\httprdr\tdxflt\objfre_wxp_x86\i386\TdxFlt_i386.pdb
Static task
static1
1 signatures
General
-
Target
c378bc9280327d74699cee3b4ab0ebd5d28f9fd7e165e963f2c0e2b6220999cdN
-
Size
98KB
-
MD5
c34c0be183069d87d837b365257efd70
-
SHA1
68a3ec71f73672ffd04b37312fc56acf5b318e26
-
SHA256
c378bc9280327d74699cee3b4ab0ebd5d28f9fd7e165e963f2c0e2b6220999cd
-
SHA512
fe4cc8ab148b3ada793973605d7c1cf65c49bf47979efbdc9ea13fa8ec3f9d6b942a0db357c375a0f081f7ffe4a5e4038e5a01496515147b768a1ffc2b4f7222
-
SSDEEP
3072:JiC/umsElmZwxXPmetcCQDwbkkG7zYgBLL9Y8Sk9:h/ums2+PCQDwbkkG78gBLL9Y8Sk9
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c378bc9280327d74699cee3b4ab0ebd5d28f9fd7e165e963f2c0e2b6220999cdN
Files
-
c378bc9280327d74699cee3b4ab0ebd5d28f9fd7e165e963f2c0e2b6220999cdN.sys windows:6 windows x86 arch:x86
9e916e229b58d1ee1b307a01e8fbbd19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
ZwCreateFile
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
memset
IoFreeMdl
MmProbeAndLockPages
IoFreeIrp
IoAllocateMdl
IofCompleteRequest
IoCancelIrp
KeQueryTimeIncrement
KeTickCount
_alldiv
_allmul
ZwFlushKey
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
memcpy
IoDeleteDevice
IoGetDeviceObjectPointer
IoCreateDevice
ZwDeleteKey
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlLargeIntegerDivide
ExSystemTimeToLocalTime
KeQuerySystemTime
_allrem
rand
srand
RtlGetVersion
RtlRandomEx
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoRegisterShutdownNotification
RtlUpcaseUnicodeString
ExAllocatePool
ExAllocatePoolWithTag
IoDetachDevice
PsGetCurrentProcessId
RtlCompareMemory
MmIsAddressValid
ProbeForWrite
ProbeForRead
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
memmove
_snprintf
strncpy
PsGetCurrentThreadId
ZwEnumerateKey
DbgPrint
strstr
_strnicmp
ZwDeleteFile
IoBuildSynchronousFsdRequest
RtlCompareUnicodeString
ZwSetInformationFile
ZwWriteFile
ZwReadFile
ZwWaitForSingleObject
ZwQueryInformationFile
IoCreateFileSpecifyDeviceObjectHint
IoGetDeviceAttachmentBaseRef
ZwOpenFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
ObQueryNameString
swprintf
ZwDeviceIoControlFile
ZwFsControlFile
KeGetCurrentThread
RtlCopyUnicodeString
IoAttachDeviceToDeviceStackSafe
PsCreateSystemThread
PsTerminateSystemThread
KeSetTimerEx
KeSetPriorityThread
KeCancelTimer
KeInitializeTimerEx
KeBugCheckEx
KeInitializeEvent
ObfDereferenceObject
KeWaitForSingleObject
ZwClose
RtlInitUnicodeString
ExFreePoolWithTag
KeSetEvent
RtlAnsiCharToUnicodeChar
RtlUnwind
hal
KfReleaseSpinLock
KfAcquireSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
Sections
.text Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ