MDE_File_Sample_c06714255b94a30244beed4088f7cedb7ce9b91f[.]zip

Resubmissions

27/05/2023, 13:39

230527-qya5gscd8x 1

27/05/2023, 13:38

230527-qxf94sca58 1

Sharing

Copy URL Twitter E-mail

General

Target

MDE_File_Sample_c06714255b94a30244beed4088f7cedb7ce9b91f.zip
Size

5.6MB
MD5

cecca036a86ee9d3fd429ac4b2abb1a0
SHA1

88090e187b82a81eb2bfed8d02de5fa5d2fc95e8
SHA256

fed380ca1ce12b79691e55230cf84b16824ce9eb8d73915d4b651aa681dae57b
SHA512

c5f2327389d7b476351051bf3ff539aaa4ea42bc1982b1d56c2d3ab977d73f5f0a282a794a4a8e717dcbd2863664f5e6f7aa4c5206fb53e94831d2b1499e3350
SSDEEP

98304:QLf1ImrW3hdHpReiZyZhespEILluj6j5IqxyKk27B4M2VMQFYKygTMr+iL:QLtIoKhdbeR/EILluj2ZLk2F9e5ogQr3

Score

1^/10

Malware Config

Signatures

Files

MDE_File_Sample_c06714255b94a30244beed4088f7cedb7ce9b91f.zip
.zip

Password: 123
ntoskrnl.exe
.exe windows x64

Password: 123

cf27126b23ab874891a16555c4997a3d

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:78:e7:83:b2:02:ee:23:d9:65:82:57:f6:fc:4a:21:43:2c:82:1d:65:91:61:de:a8:b5:ab:79:63:6b:a3:65
Signer

Actual PE Digest

e1:78:e7:83:b2:02:ee:23:d9:65:82:57:f6:fc:4a:21:43:2c:82:1d:65:91:61:de:a8:b5:ab:79:63:6b:a3:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ext-ms-win-ntos-processparameters-l1-1-0

PsDestroyProcessParameterOverrides
PsGetProcessParameterOverrides

ext-ms-win-ntos-tm-l1-1-0

NtReadOnlyEnlistment
NtQueryInformationTransactionManager
NtQueryInformationTransaction
NtQueryInformationResourceManager
NtQueryInformationEnlistment
NtPropagationFailed
NtPropagationComplete
NtPrepareEnlistment
NtPrepareComplete
NtPrePrepareEnlistment
NtPrePrepareComplete
NtOpenTransactionManager
NtOpenTransaction
NtRollbackTransaction
NtOpenEnlistment
NtGetNotificationResourceManager
NtFreezeTransactions
NtEnumerateTransactionObject
NtCreateTransactionManager
NtCreateTransaction
NtCreateResourceManager
NtCreateEnlistment
NtCommitTransaction
NtCommitEnlistment
NtCommitComplete
TmInitSystem
NtSetInformationEnlistment
NtSetInformationResourceManager
TmCommitTransaction
NtRecoverEnlistment
TmInitSystemPhase2
NtRecoverResourceManager
NtThawTransactions
TmCancelPropagationRequest
TmCommitComplete
TmCommitEnlistment
TmShutdownSystem
NtRollforwardTransactionManager
NtSinglePhaseReject
NtSetInformationTransactionManager
NtRenameTransactionManager
NtRegisterProtocolAddressInformation
TmThawTransactions
TmSinglePhaseReject
TmSetCurrentTransaction
TmRollbackTransaction
TmRollbackEnlistment
TmRollbackComplete
TmRequestOutcomeEnlistment
TmRenameTransactionManager
TmReferenceEnlistmentKey
TmRecoverTransactionManager
TmRecoverResourceManager
TmRecoverEnlistment
TmReadOnlyEnlistment
TmPropagationFailed
TmPropagationComplete
TmPrepareEnlistment
TmPrepareComplete
TmPrePrepareEnlistment
TmPrePrepareComplete
TmIsTransactionActive
TmIsKTMCommitCoordinator
TmInitializeTransactionManager
NtRecoverTransactionManager
NtRollbackComplete
NtSetInformationTransaction
NtRollbackEnlistment
TmGetTransactionId
TmFreezeTransactions
TmEndPropagationRequest
TmEnableCallbacks
TmDereferenceEnlistmentKey
TmCurrentTransaction
TmCreateEnlistment
NtOpenResourceManager

pshed

PshedDoPfa
PshedGetErrorSourceInfo
PshedInitAvailable
PshedSetErrorSourceInfo
PshedInjectError
PshedGetInjectionCapabilities
PshedDisableErrorSource
PshedEnableErrorSource
PshedInitGlobal
PshedArePluginsPresent
PshedFinalizeErrorRecord
PshedBugCheckSystem
PshedWriteErrorRecord
PshedAttemptErrorRecovery
PshedGetAllErrorSources
PshedInitialize
PshedGetBootErrorPacket
PshedAllocateMemory
PshedClearErrorRecord
PshedReadErrorRecord
PshedFreeMemory
PshedSetHalEnlightenments
PshedMarkHiberPhase
PshedInitProc
PshedIsSystemWheaEnabled
PshedRetrieveErrorInfo

bootvid

VidInitialize
VidBufferToScreenBlt
VidScreenToBufferBlt
VidBitBlt
VidResetDisplay
VidCleanUp
VidSetTextColor
VidSetScrollRegion
VidSolidColorFill
VidDisplayString
VidBitBltEx

ext-ms-win-ntos-clipsp-l1-1-0

ClipSpInitialize

kdcom

KdSetHiberRange
KdPower
KdReceivePacket
KdSendPacket
KdInitialize

ext-ms-win-ntos-kcminitcfg-l1-1-0

CmCompleteInitMachineConfig
CmSetInitMachineConfig

ext-ms-win-ntos-ksr-l1-1-3

KsrQueryMetadata
KsrClaimPersistedMemory
KsrGetFirmwareInformation
KsrInitSystem
KsrFreePersistedMemoryBlock
KsrMdlToMemoryRuns
KsrPersistMemoryWithMetadata
KsrFreePersistedMemory
KsrCleanupPageDatabase
KsrInitPageDatabase
KsrEnumeratePersistedMemory

ext-ms-win-ntos-trace-l1-1-0

TraceInitSystem

ext-ms-win-ntos-ksecurity-l1-1-1

QueryUpdateFileEaAllowedExt

ext-ms-win-ntos-werkernel-l1-1-1

WerLiveKernelCancelReport
WerLiveKernelCreateReport
WerLiveKernelSubmitReport
WerLiveKernelInitSystem
WerLiveKernelOpenDumpFile
WerLiveKernelCloseHandle

ext-ms-win-ntos-ucode-l1-1-0

ExpMicrocodeInformationLoad
ExpMicrocodeInformationUnload
ExpMicrocodeInitialization

ext-ms-win-ntos-stateseparation-l1-1-0

ExpInitializeStateSeparationPhase1
ExpInitializeStateSeparationPhase0
ExpInitializeStateSeparationPhase2

ext-ms-win-fs-clfs-l1-1-0

ClfsLsnEqual
ClfsReadRestartArea
ClfsGetLogFileInformation
ClfsMgmtDeregisterManagedClient
ClfsCloseLogFileObject
ClfsMgmtInstallPolicy
ClfsMgmtRegisterManagedClient
ClfsCreateLogFile
ClfsReadLogRecord
ClfsReadNextLogRecord
ClfsTerminateReadLog
ClfsWriteRestartArea
ClfsDeleteLogByPointer
ClfsDeleteMarshallingArea
ClfsReserveAndAppendLog
ClfsLsnInvalid
ClfsFlushToLsn
ClfsLsnContainer
ClfsLsnLess
ClfsLsnDifference
ClfsCreateMarshallingArea
ClfsAddLogContainer

ci

CiInitialize

msrpc.sys

MesHandleFree
MesEncodeIncrementalHandleCreate
MesIncrementalHandleReset
RpcExceptionFilter
NdrMesTypeEncode3
NdrMesTypeDecode3
MesDecodeBufferHandleCreate

cng.sys

BCryptExportKey

Exports

Exports

AlpcCreateSecurityContext
AlpcGetHeaderSize
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
BgkDisplayCharacter
BgkGetConsoleState
BgkGetCursorState
BgkSetCursor
CcAddDirtyPagesToExternalCache
CcAsyncCopyRead
CcCanIWrite
CcCoherencyFlushAndPurgeCache
CcCopyRead
CcCopyReadEx
CcCopyWrite
CcCopyWriteEx
CcCopyWriteWontFlush
CcDeductDirtyPagesFromExternalCache
CcDeferWrite
CcErrorCallbackRoutine
CcFastCopyRead
CcFastCopyWrite
CcFastMdlReadWait
CcFlushCache
CcFlushCacheToLsn
CcGetCachedDirtyPageCountForFile
CcGetDirtyPages
CcGetFileObjectFromBcb
CcGetFileObjectFromSectionPtrs
CcGetFileObjectFromSectionPtrsRef
CcGetFlushedValidData
CcGetLsnForFileObject
CcGetNumberOfMappedPages
CcInitializeCacheMap
CcInitializeCacheMapEx
CcIsCacheManagerCallbackNeeded
CcIsThereDirtyData
CcIsThereDirtyDataEx
CcIsThereDirtyLoggedPages
CcMapData
CcMdlRead
CcMdlReadComplete
CcMdlWriteAbort
CcMdlWriteComplete
CcPinMappedData
CcPinRead
CcPrepareMdlWrite
CcPreparePinWrite
CcPurgeCacheSection
CcRegisterExternalCache
CcRemapBcb
CcRepinBcb
CcScheduleReadAhead
CcScheduleReadAheadEx
CcSetAdditionalCacheAttributes
CcSetAdditionalCacheAttributesEx
CcSetBcbOwnerPointer
CcSetDirtyPageThreshold
CcSetDirtyPinnedData
CcSetFileSizes
CcSetFileSizesEx
CcSetLogHandleForFile
CcSetLogHandleForFileEx
CcSetLoggedDataThreshold
CcSetParallelFlushFile
CcSetReadAheadGranularity
CcSetReadAheadGranularityEx
CcTestControl
CcUninitializeCacheMap
CcUnmapFileOffsetFromSystemCache
CcUnpinData
CcUnpinDataForThread
CcUnpinRepinnedBcb
CcUnregisterExternalCache
CcWaitForCurrentLazyWriterActivity
CcZeroData
CcZeroDataOnDisk
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCallbackReleaseKeyObjectIDEx
CmGetBoundTransaction
CmGetCallbackVersion
CmKeyObjectType
CmRegisterCallback
CmRegisterCallbackEx
CmRegisterMachineHiveLoadedNotification
CmSetCallbackObjectContext
CmUnRegisterCallback
CmUnregisterMachineHiveLoadedNotification
DbgBreakPoint
DbgBreakPointWithStatus
DbgCommandString
DbgLoadImageSymbols
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt
DbgQueryDebugFilterState
DbgSetDebugFilterState
DbgSetDebugPrintCallback
DbgkLkmdRegisterCallback
DbgkLkmdUnregisterCallback
DbgkWerCaptureLiveKernelDump
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmClientRuleRegisterNotification
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegister
EmProviderRegisterEntry
EmpProviderRegister
EtwActivityIdControl
EtwEnableTrace
EtwEventEnabled
EtwProviderEnabled
EtwRegister
EtwRegisterClassicProvider
EtwSendTraceBuffer
EtwSetInformation
EtwTelemetryCoverageReport
EtwUnregister
EtwWrite
EtwWriteEndScenario
EtwWriteEx
EtwWriteStartScenario
EtwWriteString
EtwWriteTransfer
EtwpDisableStackWalkApc
EtwpReenableStackWalkApc
ExAcquireAutoExpandPushLockExclusive
ExAcquireAutoExpandPushLockShared
ExAcquireCacheAwarePushLockExclusive
ExAcquireCacheAwarePushLockExclusiveEx
ExAcquireCacheAwarePushLockSharedEx
ExAcquireFastMutex
ExAcquireFastMutexUnsafe
ExAcquireFastResourceExclusive
ExAcquireFastResourceShared
ExAcquireFastResourceSharedStarveExclusive
ExAcquirePushLockExclusiveEx
ExAcquirePushLockSharedEx
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAcquireRundownProtection
ExAcquireRundownProtectionCacheAware
ExAcquireRundownProtectionCacheAwareEx
ExAcquireRundownProtectionEx
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExAcquireSpinLockExclusive
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockShared
ExAcquireSpinLockSharedAtDpcLevel
ExActivationObjectType
ExAllocateAutoExpandPushLock
ExAllocateCacheAwarePushLock
ExAllocateCacheAwareRundownProtection
ExAllocatePool
ExAllocatePool2
ExAllocatePool3
ExAllocatePoolWithQuota
ExAllocatePoolWithQuotaTag
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExAllocateTimer
ExBlockOnAddressPushLock
ExBlockPushLock
ExCancelTimer
ExCleanupAutoExpandPushLock
ExCleanupRundownProtectionCacheAware
ExCompositionObjectType
ExConvertExclusiveToSharedLite
ExConvertFastResourceExclusiveToShared
ExConvertPushLockExclusiveToShared
ExCoreMessagingObjectType
ExCreateCallback
ExDeleteFastResource
ExDeleteLookasideListEx
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
ExDeleteTimer
ExDesktopObjectType
ExDisableResourceBoostLite
ExDisownFastResource
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
ExEnterCriticalRegionAndAcquireResourceExclusive
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
ExEnterPriorityRegionAndAcquireResourceExclusive
ExEnterPriorityRegionAndAcquireResourceShared
ExEnumHandleTable
ExEnumerateSystemFirmwareTables
ExEventObjectType
ExExtendZone
ExFetchLicenseData
ExFlushLookasideListEx
ExFreeAutoExpandPushLock
ExFreeCacheAwarePushLock
ExFreeCacheAwareRundownProtection
ExFreePool
ExFreePoolWithTag
ExGetCurrentProcessorCounts
ExGetCurrentProcessorCpuUsage
ExGetExclusiveWaiterCount
ExGetFirmwareEnvironmentVariable
ExGetFirmwareType
ExGetLicenseTamperState
ExGetPreviousMode
ExGetSharedWaiterCount
ExGetSystemFirmwareTable
ExInitializeAutoExpandPushLock
ExInitializeFastOwnerEntry
ExInitializeFastResource
ExInitializeLookasideListEx
ExInitializeNPagedLookasideList
ExInitializePagedLookasideList
ExInitializePushLock
ExInitializeResourceLite
ExInitializeRundownProtection
ExInitializeRundownProtectionCacheAware
ExInitializeRundownProtectionCacheAwareEx
ExInitializeZone
ExInterlockedAddLargeInteger
ExInterlockedAddUlong
ExInterlockedExtendZone
ExInterlockedInsertHeadList
ExInterlockedInsertTailList
ExInterlockedPopEntryList
ExInterlockedPushEntryList
ExInterlockedRemoveHeadList
ExIsFastResourceContended
ExIsFastResourceHeld
ExIsFastResourceHeldExclusive
ExIsManufacturingModeEnabled
ExIsProcessorFeaturePresent
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExIsSoftBoot
ExLocalTimeToSystemTime
ExNotifyBootDeviceRemoval
ExNotifyCallback
ExQueryDepthSList
ExQueryFastCacheDevLicense
ExQueryPoolBlockSize
ExQueryTimerResolution
ExQueryWnfStateData
ExQueueWorkItem
ExRaiseAccessViolation
ExRaiseDatatypeMisalignment
ExRaiseException
ExRaiseHardError
ExRaiseStatus
ExRawInputManagerObjectType
ExReInitializeRundownProtection
ExReInitializeRundownProtectionCacheAware
ExRealTimeIsUniversal
ExRegisterBootDevice
ExRegisterCallback
ExRegisterExtension
ExReinitializeFastResource
ExReinitializeResourceLite
ExReleaseAutoExpandPushLockExclusive
ExReleaseAutoExpandPushLockShared
ExReleaseCacheAwarePushLockExclusive
ExReleaseCacheAwarePushLockExclusiveEx
ExReleaseCacheAwarePushLockSharedEx
ExReleaseDisownedFastResource
ExReleaseDisownedFastResourceExclusive
ExReleaseDisownedFastResourceShared
ExReleaseFastMutex
ExReleaseFastMutexUnsafe
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExReleaseFastResource
ExReleaseFastResourceExclusive
ExReleaseFastResourceShared
ExReleasePushLockEx
ExReleasePushLockExclusiveEx
ExReleasePushLockSharedEx
ExReleaseResourceAndLeaveCriticalRegion
ExReleaseResourceAndLeavePriorityRegion
ExReleaseResourceForThreadLite
ExReleaseResourceLite
ExReleaseRundownProtection
ExReleaseRundownProtectionCacheAware
ExReleaseRundownProtectionCacheAwareEx
ExReleaseRundownProtectionEx
ExReleaseSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockShared
ExReleaseSpinLockSharedFromDpcLevel
ExRundownCompleted
ExRundownCompletedCacheAware
ExSemaphoreObjectType
ExSetFirmwareEnvironmentVariable
ExSetLicenseTamperState
ExSetResourceOwnerPointer
ExSetResourceOwnerPointerEx
ExSetTimer
ExSetTimerResolution
ExShareAddressSpaceWithDevice
ExSizeOfAutoExpandPushLock
ExSizeOfRundownProtectionCacheAware
ExSubscribeWnfStateChange
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExSystemExceptionFilter
ExSystemTimeToLocalTime
ExTimedWaitForUnblockPushLock
ExTimerObjectType
ExTryAcquireAutoExpandPushLockExclusive
ExTryAcquireAutoExpandPushLockShared
ExTryAcquireCacheAwarePushLockExclusiveEx
ExTryAcquireCacheAwarePushLockSharedEx
ExTryAcquirePushLockExclusiveEx
ExTryAcquirePushLockSharedEx
ExTryAcquireSpinLockExclusiveAtDpcLevel
ExTryAcquireSpinLockSharedAtDpcLevel
ExTryConvertPushLockSharedToExclusiveEx
ExTryConvertSharedSpinLockExclusive
ExTryQueueWorkItem
ExTryToAcquireFastMutex
ExTryToAcquireResourceExclusiveLite
ExTryToConvertFastResourceSharedToExclusive
ExUnblockOnAddressPushLockEx
ExUnblockPushLockEx
ExUnregisterCallback
ExUnregisterExtension
ExUnsubscribeWnfStateChange
ExUpdateLicenseData
ExUuidCreate
ExVerifySuite
ExWaitForRundownProtectionRelease
ExWaitForRundownProtectionReleaseCacheAware
ExWaitForUnblockPushLock
ExWindowStationObjectType
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfReleasePushLock
ExfReleasePushLockExclusive
ExfReleasePushLockShared
ExfTryAcquirePushLockShared
ExfTryToWakePushLock
ExfUnblockPushLock
ExpInterlockedFlushSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
FirstEntrySList
FsRtlAcknowledgeEcp
FsRtlAcquireEofLock
FsRtlAcquireFileExclusive
FsRtlAcquireHeaderMutex
FsRtlAddBaseMcbEntry
FsRtlAddBaseMcbEntryEx
FsRtlAddLargeMcbEntry
FsRtlAddMcbEntry
FsRtlAddToTunnelCache
FsRtlAddToTunnelCacheEx
FsRtlAllocateExtraCreateParameter
FsRtlAllocateExtraCreateParameterFromLookasideList
FsRtlAllocateExtraCreateParameterList
FsRtlAllocateFileLock
FsRtlAllocatePool
FsRtlAllocatePoolWithQuota
FsRtlAllocatePoolWithQuotaTag
FsRtlAllocatePoolWithTag
FsRtlAllocateResource
FsRtlAreNamesEqual
FsRtlAreThereCurrentOrInProgressFileLocks
FsRtlAreThereWaitingFileLocks
FsRtlAreVolumeStartupApplicationsComplete
FsRtlBalanceReads
FsRtlCancellableWaitForMultipleObjects
FsRtlCancellableWaitForSingleObject
FsRtlChangeBackingFileObject
FsRtlCheckLockForOplockRequest
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlCheckOplock
FsRtlCheckOplockEx
FsRtlCheckOplockEx2
FsRtlCheckUpperOplock
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCreateSectionForDataScan
FsRtlCurrentBatchOplock
FsRtlCurrentOplock
FsRtlCurrentOplockH
FsRtlDeleteExtraCreateParameterLookasideList
FsRtlDeleteKeyFromTunnelCache
FsRtlDeleteTunnelCache
FsRtlDeregisterUncProvider
FsRtlDismountComplete
FsRtlDissectDbcs
FsRtlDissectName
FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlFindExtraCreateParameter
FsRtlFindInTunnelCache
FsRtlFindInTunnelCacheEx
FsRtlFreeExtraCreateParameter
FsRtlFreeExtraCreateParameterList
FsRtlFreeFileLock
FsRtlGetCurrentProcessLoaderList
FsRtlGetEcpListFromIrp
FsRtlGetFileNameInformation
FsRtlGetFileSize
FsRtlGetIoAtEof
FsRtlGetNextBaseMcbEntry
FsRtlGetNextExtraCreateParameter
FsRtlGetNextFileLock
FsRtlGetNextLargeMcbEntry
FsRtlGetNextMcbEntry
FsRtlGetSectorSizeInformation
FsRtlGetSupportedFeatures
FsRtlGetVirtualDiskNestingLevel
FsRtlHeatInit
FsRtlHeatLogIo
FsRtlHeatLogTierMove
FsRtlHeatUninit
FsRtlIncrementCcFastMdlReadWait
FsRtlIncrementCcFastReadNoWait
FsRtlIncrementCcFastReadNotPossible
FsRtlIncrementCcFastReadResourceMiss
FsRtlIncrementCcFastReadWait
FsRtlInitExtraCreateParameterLookasideList
FsRtlInitializeBaseMcb
FsRtlInitializeBaseMcbEx
FsRtlInitializeEofLock
FsRtlInitializeExtraCreateParameter
FsRtlInitializeExtraCreateParameterList
FsRtlInitializeFileLock
FsRtlInitializeLargeMcb
FsRtlInitializeMcb
FsRtlInitializeOplock
FsRtlInitializeTunnelCache
FsRtlInsertExtraCreateParameter
FsRtlInsertPerFileContext
FsRtlInsertPerFileObjectContext
FsRtlInsertPerStreamContext
FsRtlIs32BitProcess
FsRtlIsDaxVolume
FsRtlIsDbcsInExpression
FsRtlIsEcpAcknowledged
FsRtlIsEcpFromUserMode
FsRtlIsExtentDangling
FsRtlIsFatDbcsLegal
FsRtlIsHpfsDbcsLegal
FsRtlIsMobileOS
FsRtlIsNameInExpression
FsRtlIsNameInUnUpcasedExpression
FsRtlIsNonEmptyDirectoryReparsePointAllowed
FsRtlIsNtstatusExpected
FsRtlIsPagingFile
FsRtlIsSystemPagingFile
FsRtlIsTotalDeviceFailure
FsRtlIssueDeviceIoControl
FsRtlKernelFsControlFile
FsRtlLegalAnsiCharacterArray
FsRtlLogCcFlushError
FsRtlLookupBaseMcbEntry
FsRtlLookupLargeMcbEntry
FsRtlLookupLastBaseMcbEntry
FsRtlLookupLastBaseMcbEntryAndIndex
FsRtlLookupLastLargeMcbEntry
FsRtlLookupLastLargeMcbEntryAndIndex
FsRtlLookupLastMcbEntry
FsRtlLookupMcbEntry
FsRtlLookupPerFileContext
FsRtlLookupPerFileObjectContext
FsRtlLookupPerStreamContextInternal
FsRtlMdlRead
FsRtlMdlReadComplete
FsRtlMdlReadCompleteDev
FsRtlMdlReadDev
FsRtlMdlReadEx
FsRtlMdlWriteComplete
FsRtlMdlWriteCompleteDev
FsRtlMupGetProviderIdFromName
FsRtlMupGetProviderInfoFromFileObject
FsRtlNormalizeNtstatus
FsRtlNotifyChangeDirectory
FsRtlNotifyCleanup
FsRtlNotifyCleanupAll
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterChangeDirectoryLite
FsRtlNotifyFilterReportChange
FsRtlNotifyFilterReportChangeLite
FsRtlNotifyFilterReportChangeLiteEx
FsRtlNotifyFullChangeDirectory
FsRtlNotifyFullReportChange
FsRtlNotifyInitializeSync
FsRtlNotifyReportChange
FsRtlNotifyUninitializeSync

Sections

.rdata
Size: 799KB - Virtual size: 798KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 415KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PROTDATA
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

GFIDS
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Pad1
Size: - Virtual size: 676KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

POOLCODE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFY
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEHDLS
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEBGFX
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INITKDBG
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TRACESUP
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

KVASCODE
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RETPOL
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

MINIEX
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 555KB - Virtual size: 554KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Pad2
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 1000KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALMOSTRO
Size: 5KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CACHEALI
Size: 512B - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEDATA
Size: 6KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEVRFD
Size: 32KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INITDATA
Size: 2KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Pad3
Size: - Virtual size: 584KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CFGRO
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Pad4
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: 123

Password: 123

cf27126b23ab874891a16555c4997a3d

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e1:78:e7:83:b2:02:ee:23:d9:65:82:57:f6:fc:4a:21:43:2c:82:1d:65:91:61:de:a8:b5:ab:79:63:6b:a3:65Signer

Headers

DLL Characteristics

File Characteristics

Imports

ext-ms-win-ntos-processparameters-l1-1-0

ext-ms-win-ntos-tm-l1-1-0

pshed

bootvid

ext-ms-win-ntos-clipsp-l1-1-0

kdcom

ext-ms-win-ntos-kcminitcfg-l1-1-0

ext-ms-win-ntos-ksr-l1-1-3

ext-ms-win-ntos-trace-l1-1-0

ext-ms-win-ntos-ksecurity-l1-1-1

ext-ms-win-ntos-werkernel-l1-1-1

ext-ms-win-ntos-ucode-l1-1-0

ext-ms-win-ntos-stateseparation-l1-1-0

ext-ms-win-fs-clfs-l1-1-0

ci

msrpc.sys

cng.sys

Exports

Exports

Sections

.rdata Size: 799KB - Virtual size: 798KB

.pdata Size: 415KB - Virtual size: 414KB

.idata Size: 8KB - Virtual size: 8KB

.edata Size: 99KB - Virtual size: 99KB

PROTDATA Size: 512B - Virtual size: 1B

GFIDS Size: 35KB - Virtual size: 34KB

Pad1 Size: - Virtual size: 676KB

.text Size: 3.8MB - Virtual size: 3.8MB

PAGE Size: 3.8MB - Virtual size: 3.8MB

PAGELK Size: 148KB - Virtual size: 147KB

POOLCODE Size: 1KB - Virtual size: 1KB

PAGEKD Size: 23KB - Virtual size: 22KB

PAGEVRFY Size: 200KB - Virtual size: 200KB

PAGEHDLS Size: 9KB - Virtual size: 9KB

PAGEBGFX Size: 26KB - Virtual size: 26KB

INITKDBG Size: 101KB - Virtual size: 101KB

TRACESUP Size: 6KB - Virtual size: 5KB

KVASCODE Size: 9KB - Virtual size: 8KB

RETPOL Size: 2KB - Virtual size: 1KB

MINIEX Size: 9KB - Virtual size: 9KB

INIT Size: 555KB - Virtual size: 554KB

Pad2 Size: - Virtual size: 1.4MB

.data Size: 76KB - Virtual size: 1000KB

ALMOSTRO Size: 5KB - Virtual size: 156KB

CACHEALI Size: 512B - Virtual size: 36KB

PAGEDATA Size: 6KB - Virtual size: 72KB

PAGEVRFD Size: 32KB - Virtual size: 87KB

INITDATA Size: 2KB - Virtual size: 95KB

Pad3 Size: - Virtual size: 584KB

CFGRO Size: 7KB - Virtual size: 7KB

Pad4 Size: - Virtual size: 2.0MB

.rsrc Size: 237KB - Virtual size: 236KB

.reloc Size: 38KB - Virtual size: 38KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e1:78:e7:83:b2:02:ee:23:d9:65:82:57:f6:fc:4a:21:43:2c:82:1d:65:91:61:de:a8:b5:ab:79:63:6b:a3:65
Signer

.rdata
Size: 799KB - Virtual size: 798KB

.pdata
Size: 415KB - Virtual size: 414KB

.idata
Size: 8KB - Virtual size: 8KB

.edata
Size: 99KB - Virtual size: 99KB

PROTDATA
Size: 512B - Virtual size: 1B

GFIDS
Size: 35KB - Virtual size: 34KB

Pad1
Size: - Virtual size: 676KB

.text
Size: 3.8MB - Virtual size: 3.8MB

PAGE
Size: 3.8MB - Virtual size: 3.8MB

PAGELK
Size: 148KB - Virtual size: 147KB

POOLCODE
Size: 1KB - Virtual size: 1KB

PAGEKD
Size: 23KB - Virtual size: 22KB

PAGEVRFY
Size: 200KB - Virtual size: 200KB

PAGEHDLS
Size: 9KB - Virtual size: 9KB

PAGEBGFX
Size: 26KB - Virtual size: 26KB

INITKDBG
Size: 101KB - Virtual size: 101KB

TRACESUP
Size: 6KB - Virtual size: 5KB

KVASCODE
Size: 9KB - Virtual size: 8KB

RETPOL
Size: 2KB - Virtual size: 1KB

MINIEX
Size: 9KB - Virtual size: 9KB

INIT
Size: 555KB - Virtual size: 554KB

Pad2
Size: - Virtual size: 1.4MB

.data
Size: 76KB - Virtual size: 1000KB

ALMOSTRO
Size: 5KB - Virtual size: 156KB

CACHEALI
Size: 512B - Virtual size: 36KB

PAGEDATA
Size: 6KB - Virtual size: 72KB

PAGEVRFD
Size: 32KB - Virtual size: 87KB

INITDATA
Size: 2KB - Virtual size: 95KB

Pad3
Size: - Virtual size: 584KB

CFGRO
Size: 7KB - Virtual size: 7KB

Pad4
Size: - Virtual size: 2.0MB

.rsrc
Size: 237KB - Virtual size: 236KB

.reloc
Size: 38KB - Virtual size: 38KB