Driver sys 文件恶意软件分析

技术分析

文件名	driver.sys
文件类型	PE32+ executable (native) x86-64, for MS Windows
扫描器版本	1.0.220.174
数据库版本	2025-07-14 20:00:18 UTC

扫描另一个文件

文件识别

哈希类型	值	操作
MD5	29fa05cda350ef7851307f5df060480b
SHA1	937f369b3eaeca03863ce9f8d5767f62ff1996bf
SHA256	781692e9c69451ccccf2f6d26060668a16a57ba9c11e8d91069e11f673044036
SHA512	afd3c66a6e344bd783ccf0345a25ad8a57d5957c66edbf46267b4d5bd7b645cd7b868594f4043ac589e5a207cb76ea30b4021d4b365dbc8e4e910a3b7ac29fbb
ImpHash	b6f895a45ad81c631b50c673c9cde112

PE 分析

基本信息

▼

映像基址	`0x140000000`
入口点	`0x1400193c4`
编译时间	2013-07-07 20:38:09
校验和	0x0003a34a (实际: 0x000438ee)
操作系统版本	10.0
PEiD 签名	`PE32+ executable (native) x86-64, for MS Windows`
PDB 路径	`C:\Users\Admin\source\repos\mbandit1337\ultimateShell_spoofer\x64\Release\driver.pdb`
数字签名	An error occurred while validating the countersignature: Chain verification from [email protected], C=US, ST=California, L=San Francisco, O=take2games, CN=TakeTwo\ (serial:555180657046577999502970372403253297827935342542, sha1:0dd370f845a480836c9ae9b9db616bd03d0f5962) failed: Unable to build a validation path for the certificate "Email Address: [email protected], Country: US, State/Province: California, Locality: San Francisco, Organization: take2games, Common Name: TakeTwo " - no issuer matching "Common Name: TakeTwo Root CA" was found
导入	1 库 ntoskrnl
导出	0 函数
资源	0 资源
节	5 节

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	136,057 bytes	136,192 bytes	6.18 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`A5B86FEF1112BE295D21C0A29526D6BB`
`.rdata`	`0x00023000`	3,580 bytes	3,584 bytes	5.27 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ`	`3003894B781CED137C5C5035A87E7FD0`
`.data`	`0x00024000`	79,496 bytes	77,824 bytes	7.92 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`112F6F207555F342091E80C7A3344E2B`
`.pdata`	`0x00038000`	528 bytes	1,024 bytes	2.98 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ`	`58F0501EBF58481AEB12D16ADA068882`
`INIT`	`0x00039000`	428 bytes	512 bytes	4.03 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F8FFE956006C01CAEE8EB045DA6819C5`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

An error occurred while validating the countersignature: Chain verification from [email protected], C=US, ST=California, L=San Francisco, O=take2games, CN=TakeTwo\ (serial:555180657046577999502970372403253297827935342542, sha1:0dd370f845a480836c9ae9b9db616bd03d0f5962) failed: Unable to build a validation path for the certificate "Email Address: [email protected], Country: US, State/Province: California, Locality: San Francisco, Organization: take2games, Common Name: TakeTwo " - no issuer matching "Common Name: TakeTwo Root CA" was found

建议: 验证文件来源并确保它来自可信的发布者.

Driver.sys 文件分析