filenamedriver.sys
size8704 (0x2200)
md54680fddfc15860b48c53bee0298c6a77
typePE32+ executable (native) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
257331363
1016
259331364
260331365
261338111
258338111

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x66c765da
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.40
SizeOfCode0x1200
SizeOfInitializedData0xc00
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion10.0
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x400
CheckSum0xb865
Subsystem1
DllCharacteristics0x4160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xd1e0xe00R-X CODE
.rdata0x20000x5000x600R-- IDATA
.data0x30000x700x200RW- IDATA
.pdata0x40000xd80x200R-- IDATA
INIT0x50000x2180x400R-X CODE DISCARDABLE
.reloc0x60000x240x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x50000x28
RESOURCE00
EXCEPTION0x40000xd8
SECURITY00
BASERELOC0x60000x24
DEBUG0x22200x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x20e00x140
Bound_IAT00
IAT0x20000x88
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
ntoskrnl.exe2362RtlInitUnicodeString
ntoskrnl.exe2344RtlGetVersion
ntoskrnl.exe202ExAllocatePool
ntoskrnl.exe252ExFreePoolWithTag
ntoskrnl.exe1613MmUnmapIoSpace
ntoskrnl.exe1566MmMapIoSpaceEx
ntoskrnl.exe1142IofCompleteRequest
ntoskrnl.exe835IoCreateDevice
ntoskrnl.exe848IoCreateSymbolicLink
ntoskrnl.exe861IoDeleteDevice
ntoskrnl.exe1787ObfDereferenceObject
ntoskrnl.exe1520MmCopyMemory
ntoskrnl.exe2025PsLookupProcessByProcessId
ntoskrnl.exe838IoCreateDriver
ntoskrnl.exe1968PsGetProcessSectionBaseAddress
ntoskrnl.exe3065ZwQuerySystemInformation
offsetsizetypecomment
15c115HTM#
15d03120BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK