mbam.sys

Malwarebytes Anti-Malware

Malwarebytes Corporation

It runs as a Windows file system device driver named “MBAMProtector”.
Publisher:
Malwarebytes Corporation  (signed and verified)

Product:
Malwarebytes Anti-Malware

Version:
0.1.13.0

MD5:
ee7444334bce24ac3464d538f1f78633

SHA-1:
b762c5629e263253813bce48780235f8811b1c5b

SHA-256:
1c57e08d777db25ab306d5d0d3d7d5f07e8daa6889309ee3d1de461dbbc1cb33

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/11/2016 3:18:37 AM UTC  (today)

File size:
22.7 KB (23,256 bytes)

Product version:
0.1.13.0

Copyright:
© Malwarebytes Corporation. All rights reserved.

Original file name:
mbam.sys

File type:
Driver (Win32 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\mbam.sys

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
4/29/2013 8:00:00 PM

Valid to:
6/19/2016 7:59:59 PM

Subject:
CN=Malwarebytes Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Malwarebytes Corporation, L=San Jose, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
6F36C4B74B4F8AB001F039D692A75B49

File PE Metadata
Compilation timestamp:
10/30/2013 12:11:40 PM

OS version:
6.1

OS bitness:
Win32

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
384:XlBX6XVL7FVSF9Z0woAYmqinYPLczUHeM4WD:+VXFcFz09SRg

Entry address:
0x603E

Entry point:
8B, FF, 55, 8B, EC, E8, BD, FF, FF, FF, 5D, E9, 92, B4, FF, FF, CC, CC, 0C, 61, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 64, 00, 00, 6C, 40, 00, 00, FC, 60, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 62, 64, 00, 00, 5C, 40, 00, 00, A0, 60, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, AE, 66, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 82, 66, 00, 00, 62, 66, 00, 00, 4A, 66, 00, 00, 2C, 66, 00, 00, 0C, 66, 00, 00, F0, 65, 00, 00, D4, 65, 00, 00, B6, 65...
 
[+]

Entropy:
6.5134

Code size:
10.5 KB (10,752 bytes)

Driver
Display name:
MBAMProtector

Type:
File system 'filter' driver (FileSystemDriver)

Group:
FSFilter Anti-Virus

Depends on:
FltMgr