KDUFILTER[.]sys

Sharing

Copy URL

Twitter E-mail

General

Target

KDUFILTER.sys
Size

35KB
MD5

1852619dc0a55e275adcfe3218290f99
SHA1

81712b70eefd88877f388159ff9008ca2952857b
SHA256

0b1662ca705c22c77ae43ee9ac8d3d21fd3cd3543c165fd33de240ee11d82801
SHA512

7991c27b73480846db91e6b097a565131faf04efd12d53101bb5527678bf92756d08d8a03aae623df6b2ac5a08e9d54f2f276d10291ccf7f21d34595c5f8b4d9
SSDEEP

768:objkvXpkysJF/l0WCilLYjmZl84cTzxbDHuaJnh/2kl4zSyI3S/S/w0N:ZZkTBbFZl34nh/YaKKT

Score

1^/10

Malware Config

Signatures

Files

KDUFILTER.sys
.exe windows x64

afe4304ed8bda96d95f9a2f5ad462448

Code Sign

1e:16:2f:70:50:77:0d:8c:4f:b1:7f:ba:65:15:fc:d2
Certificate

Issuer

CN=WDKTestCert X\,133243560477158738

Not Before

27-03-2023 02:00

Not After

27-03-2033 00:00

Subject

CN=WDKTestCert X\,133243560477158738

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

48:0c:cd:73:6f:1e:6b:4f:d5:0c:8d:bf:b5:03:6d:0b:9a:8b:1e:36:15:8c:b9:57:63:c1:80:2f:4d:e8:ad:bf
Signer

Actual PE Digest

48:0c:cd:73:6f:1e:6b:4f:d5:0c:8d:bf:b5:03:6d:0b:9a:8b:1e:36:15:8c:b9:57:63:c1:80:2f:4d:e8:ad:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExFreePoolWithTag
DbgPrint
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
MmGetPhysicalAddress
ZwClose
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
MmUnmapIoSpace
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
RtlFreeUnicodeString
MmMapIoSpace
RtlCopyUnicodeString
DbgPrintEx
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
__C_specific_handler
ExAllocatePoolWithTag
RtlGetVersion
RtlCompareUnicodeString
SeExports
MmGetSystemRoutineAddress

fltmgr.sys

FltGetFilterInformation
FltEnumerateFilters
FltEnumerateInstances

wdfldr.sys

WdfVersionBindClass
WdfVersionBind
WdfLdrQueryInterface
WdfVersionUnbind
WdfVersionUnbindClass

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afe4304ed8bda96d95f9a2f5ad462448

Code Sign

1e:16:2f:70:50:77:0d:8c:4f:b1:7f:ba:65:15:fc:d2Certificate

Extended Key Usages

Key Usages

48:0c:cd:73:6f:1e:6b:4f:d5:0c:8d:bf:b5:03:6d:0b:9a:8b:1e:36:15:8c:b9:57:63:c1:80:2f:4d:e8:ad:bfSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

fltmgr.sys

wdfldr.sys

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 5KB - Virtual size: 6KB

.pdata Size: 1024B - Virtual size: 828B

PAGE Size: 8KB - Virtual size: 8KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 504B

1e:16:2f:70:50:77:0d:8c:4f:b1:7f:ba:65:15:fc:d2
Certificate

48:0c:cd:73:6f:1e:6b:4f:d5:0c:8d:bf:b5:03:6d:0b:9a:8b:1e:36:15:8c:b9:57:63:c1:80:2f:4d:e8:ad:bf
Signer

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 5KB - Virtual size: 6KB

.pdata
Size: 1024B - Virtual size: 828B

PAGE
Size: 8KB - Virtual size: 8KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 504B