| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_NATIVE
|
| Compilation Date | 2026-Jan-30 06:30:06 |
| Detected languages |
Chinese - PRC
|
| CompanyName | PerfectWorld Ltd. |
| FileDescription | Protection Kernel Driver |
| FileVersion | 1.0.0.2 |
| InternalName | MessageTransfer.sys |
| LegalCopyright | Copyright (C) 2022 |
| OriginalFilename | MessageTransfer.sys |
| ProductName | MessageTransfer |
| ProductVersion | 1.0.0.2 |
| Info | Matching compiler(s): | MASM/TASM - sig1(h) |
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Suspicious | The PE is possibly packed. |
Unusual section name found: PAGE
Unusual section name found: .pac0 |
| Suspicious | The PE contains functions most legitimate programs don't use. |
Functions which can be used for anti-debugging purposes:
|
| Info | The PE is digitally signed. |
Signer: \xE5\xAE\x8C\xE7\xBE\x8E\xE4\xB8\x96\xE7\x95\x8C\xE5\xBE\x81\xE5\xA5\x87\xEF\xBC\x88\xE4\xB8\x8A\xE6\xB5\xB7\xEF\xBC\x89\xE5\xA4\x9A\xE5\xAA\x92\xE4\xBD\x93\xE7\xA7\x91\xE6\x8A\x80\xE6\x9C\x89\xE9\x99\x90\xE5\x85\xAC\xE5\x8F\xB8
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| Suspicious | No VirusTotal score. | This file has never been scanned on VirusTotal. |
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 9 |
| TimeDateStamp | 2026-Jan-30 06:30:06 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x1ce00 |
| SizeOfInitializedData | 0x219a00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0000000000239250 (Section: INIT) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | A.0 |
| ImageVersion | A.0 |
| SubsystemVersion | 6.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x646000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x43b70d |
| Subsystem |
IMAGE_SUBSYSTEM_NATIVE
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
| FLTMGR.SYS |
FltRegisterFilter
FltUnregisterFilter FltStartFiltering FltGetFileNameInformation FltReleaseFileNameInformation FltParseFileNameInformation FltCreateCommunicationPort FltCloseCommunicationPort FltCloseClientPort FltBuildDefaultSecurityDescriptor FltFreeSecurityDescriptor |
|---|---|
| ntoskrnl.exe |
vDbgPrintEx
KeQueryActiveProcessorCountEx ExAllocatePoolWithTag ExFreePoolWithTag MmAllocateContiguousMemory MmFreeContiguousMemory MmGetPhysicalAddress RtlCaptureContext KeInitializeDpc KeInsertQueueDpc RtlWalkFrameChain MmIsAddressValid PsGetCurrentProcessId PsGetCurrentThreadId KeInitializeApc KeInsertQueueApc ZwQuerySystemInformation RtlInitAnsiString RtlInitUnicodeString RtlAnsiStringToUnicodeString RtlUnicodeStringToAnsiString RtlFreeUnicodeString RtlFreeAnsiString MmMapIoSpace MmUnmapIoSpace HalDispatchTable KeSetEvent MmGetSystemRoutineAddress KeInitializeEvent KeDelayExecutionThread KeWaitForSingleObject PsCreateSystemThread PsTerminateSystemThread ObReferenceObjectByHandle ObfDereferenceObject ZwClose swprintf_s PsThreadType RtlCompareUnicodeString RtlCopyUnicodeString KeInitializeGuardedMutex KeAcquireGuardedMutex KeReleaseGuardedMutex RtlStringFromGUID ZwCreateFile ZwOpenFile ZwReadFile ZwWriteFile ZwOpenKey ZwQueryValueKey ExUuidCreate KeSetSystemGroupAffinityThread KeRevertToUserGroupAffinityThread KeGetProcessorNumberFromIndex KeResetEvent MmProbeAndLockPages MmUnlockPages MmBuildMdlForNonPagedPool IoAllocateMdl __C_specific_handler IoFreeMdl IoReuseIrp strcat_s _stricmp _strlwr wcscat_s MmGetVirtualForPhysical RtlAppendUnicodeToString ProbeForRead MmMapLockedPagesSpecifyCache MmUnmapLockedPages IoGetCurrentProcess ObRegisterCallbacks ObUnRegisterCallbacks PsSetCreateProcessNotifyRoutine PsSetCreateThreadNotifyRoutine PsRemoveCreateThreadNotifyRoutine PsSetLoadImageNotifyRoutine PsRemoveLoadImageNotifyRoutine PsGetProcessId KeStackAttachProcess KeUnstackDetachProcess PsLookupProcessByProcessId ObOpenObjectByPointer ObQueryNameString ZwQueryVirtualMemory ZwQueryInformationProcess PsGetProcessImageFileName PsGetProcessSectionBaseAddress PsProcessType RtlInitializeGenericTableAvl RtlInsertElementGenericTableAvl RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl RtlEnumerateGenericTableAvl _strnicmp strstr _wcslwr RtlGetVersion ExAllocatePool MmAllocateContiguousMemorySpecifyCacheNode ZwSetInformationFile RtlEnumerateGenericTableWithoutSplayingAvl PsGetProcessExitStatus PsGetThreadId PsGetThreadProcessId NtClose PsLookupThreadByThreadId PsGetThreadProcess IoQueryFileDosDeviceName ZwOpenDirectoryObject ZwFreeVirtualMemory ZwQueryInformationThread ZwOpenThread _vsnwprintf ObReferenceObjectByName RtlFindExportedRoutineByName ZwQueryDirectoryObject IoFileObjectType IoDriverObjectType KeClearEvent wcscpy_s ZwCreateKey ZwFlushKey ZwSetValueKey KeIpiGenericCall KeBugCheckEx wcsstr IoFreeIrp |
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.2 |
| ProductVersion | 1.0.0.2 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Chinese - PRC |
| CompanyName | PerfectWorld Ltd. |
| FileDescription | Protection Kernel Driver |
| FileVersion (#2) | 1.0.0.2 |
| InternalName | MessageTransfer.sys |
| LegalCopyright | Copyright (C) 2022 |
| OriginalFilename | MessageTransfer.sys |
| ProductName | MessageTransfer |
| ProductVersion (#2) | 1.0.0.2 |
| Resource LangID | Chinese - PRC |
|---|
| Size | 0x118 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140020098 |
| GuardCFCheckFunctionPointer | 5368829040 |
| GuardCFDispatchFunctionPointer | 0 |
| GuardCFFunctionTable | 0 |
| GuardCFFunctionCount | 0 |
| GuardFlags | (EMPTY) |
| CodeIntegrity.Flags | 0 |
| CodeIntegrity.Catalog | 0 |
| CodeIntegrity.CatalogOffset | 0 |
| CodeIntegrity.Reserved | 0 |
| GuardAddressTakenIatEntryTable | 0 |
| GuardAddressTakenIatEntryCount | 0 |
| GuardLongJumpTargetTable | 0 |
| GuardLongJumpTargetCount | 0 |