NA_rawaccelsys_JC[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

NA_rawaccelsys_JC.sys
Size

49KB
MD5

71f344ff16eef68a0805b747ea9ab85a
SHA1

3224069aaec50d57f7ff2db31064fd14f95cb9ea
SHA256

fc1d9eef1f99951f14e53e14250ef944c5dcd82117497a1eaf5ced6623b6855a
SHA512

338b2ecf11a0e62bf70f8fa55dc27ef13f7e54fd01611b4fc7c5788a612540dfe8f9ddd2688868afb326e616a9440e47ca3d703c322e993989035e611797400c
SSDEEP

768:mGFZ5+o2cZsU134/sSqGCHzn52Ene4ExHtq6Cbf2Q+IRNJ4/UOdt3s4:mGZ8oZJ40Hj554HoUqNJ4sOdtc4

Score

1^/10

Malware Config

Signatures

Files

NA_rawaccelsys_JC.sys
.exe windows x64

cfbb64f2d3e0f33a866ec9b25ea72a0c

Code Sign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:25

Not After

02/12/2021, 22:25

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:28:06:ce:40:b6:44:8d:68:0c:6b:3c:5e:08:0c:6e:e2:05:86:2d:3d:95:95:e4:6a:e4:1d:bf:94:fe:d4:f5
Signer

Actual PE Digest

4b:28:06:ce:40:b6:44:8d:68:0c:6b:3c:5e:08:0c:6e:e2:05:86:2d:3d:95:95:e4:6a:e4:1d:bf:94:fe:d4:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoBuildSynchronousFsdRequest
IofCallDriver
InitSafeBootMode
wcsncpy
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlCopyUnicodeString
DbgPrintEx
__C_specific_handler
RtlRaiseException
KeWaitForSingleObject
KeDelayExecutionThread
KeInitializeEvent
wcsncmp

hal

KeQueryPerformanceCounter

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfbb64f2d3e0f33a866ec9b25ea72a0c

Code Sign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

4b:28:06:ce:40:b6:44:8d:68:0c:6b:3c:5e:08:0c:6e:e2:05:86:2d:3d:95:95:e4:6a:e4:1d:bf:94:fe:d4:f5Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 10KB - Virtual size: 10KB

.pdata Size: 1024B - Virtual size: 816B

PAGE Size: 3KB - Virtual size: 3KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 640B

.reloc Size: 512B - Virtual size: 52B

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

4b:28:06:ce:40:b6:44:8d:68:0c:6b:3c:5e:08:0c:6e:e2:05:86:2d:3d:95:95:e4:6a:e4:1d:bf:94:fe:d4:f5
Signer

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 10KB - Virtual size: 10KB

.pdata
Size: 1024B - Virtual size: 816B

PAGE
Size: 3KB - Virtual size: 3KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 640B

.reloc
Size: 512B - Virtual size: 52B