LeCrud64[.]sys

Resubmissions

25/04/2023, 17:11

230425-vqr59abg32 1

25/04/2023, 17:11

230425-vqdb4abg26 1

Sharing

Copy URL Twitter E-mail

General

Target

LeCrud64.sys
Size

15KB
MD5

1f2109002a0a8ca2ee7457e933069847
SHA1

b78ff33cefbc1972202e61d930945c9c094e2d09
SHA256

b17f258a00c7c4339a4a79817e3ed0ebe8c2cf96829e286117994b6f1f106837
SHA512

9b70f5c8311797d100e2f83b7249c1f89bf0e40302e3c72d8fb04fe616e887a4451451758af21a1fa72c900bf1f9fc196c893fce2b89c825edbca33daaf4b2b9
SSDEEP

192:2Xmn8HcxCC9l0HhaKW9d2gRxBy8axBAfJkqXgf1t8NPRhuGKFIiwBjtlAq:gO0Hh5WgZxEJkz6RdiOUq

Score

1^/10

Malware Config

Signatures

Files

LeCrud64.sys
.exe windows x64

db4408247c447c666c12863d8fa61ff5

Code Sign

57:16:18:0d:b7:d4:98:9d:c4:a1:70:83:dc:fa:75:67
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/01/2015, 00:00

Not After

12/01/2018, 23:59

Subject

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:be:f7:55:46:d8:ad:3f:97:61:89:4b:5a:ae:00:42:ca:15:4c:0b:d4:ed:e5:83:f0:ec:a4:71:b2:6c:42:12
Signer

Actual PE Digest

c8:be:f7:55:46:d8:ad:3f:97:61:89:4b:5a:ae:00:42:ca:15:4c:0b:d4:ed:e5:83:f0:ec:a4:71:b2:6c:42:12

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

25/04/2023, 11:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
IoDeleteSymbolicLink
ExFreePoolWithTag
strncmp
RtlInitUnicodeString
IoDeleteDevice
MmFreeContiguousMemory
MmUnmapIoSpace
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
IofCompleteRequest
MmProbeAndLockPages
MmUnlockPages
IoCreateSymbolicLink
IoCreateDevice
IoAllocateMdl
MmAllocateContiguousMemory
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

db4408247c447c666c12863d8fa61ff5

Code Sign

57:16:18:0d:b7:d4:98:9d:c4:a1:70:83:dc:fa:75:67Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

c8:be:f7:55:46:d8:ad:3f:97:61:89:4b:5a:ae:00:42:ca:15:4c:0b:d4:ed:e5:83:f0:ec:a4:71:b2:6c:42:12Signer

Signature Validations

Verification

25/04/2023, 11:12 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 512B - Virtual size: 484B

.data Size: 512B - Virtual size: 276B

.pdata Size: 512B - Virtual size: 144B

PAGE Size: 3KB - Virtual size: 3KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 16B

57:16:18:0d:b7:d4:98:9d:c4:a1:70:83:dc:fa:75:67
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

c8:be:f7:55:46:d8:ad:3f:97:61:89:4b:5a:ae:00:42:ca:15:4c:0b:d4:ed:e5:83:f0:ec:a4:71:b2:6c:42:12
Signer

25/04/2023, 11:12
Valid: false

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 484B

.data
Size: 512B - Virtual size: 276B

.pdata
Size: 512B - Virtual size: 144B

PAGE
Size: 3KB - Virtual size: 3KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 16B