cf9a175fa350197e537292a36db7f8bdd7eef07b7aae8a0fe6d5c9451642df40

Sharing

Copy URL Twitter E-mail

General

Target

cf9a175fa350197e537292a36db7f8bdd7eef07b7aae8a0fe6d5c9451642df40
Size

6.9MB
MD5

83323c144be2e9211f5c9ec9b8ef48e0
SHA1

715025fec1213c21690ef73e5b62eaacce4b4b8f
SHA256

cf9a175fa350197e537292a36db7f8bdd7eef07b7aae8a0fe6d5c9451642df40
SHA512

b6fd2c03449d9aef861207e27459998722574da9b681b3b588886635c2381785c108665c3d8f70dbd75f406556121dd8d7ba6bb2af16be9df906d79a3596f631
SSDEEP

196608:HDU7cZbn+9q3ey521NjdkBru+yXoEuJLb6KSDsu7:HDU7cFKNj+04EQ3hlm

Score

1^/10

Malware Config

Signatures

Files

cf9a175fa350197e537292a36db7f8bdd7eef07b7aae8a0fe6d5c9451642df40
.sys windows:10 windows x64

e3dee97d4282ee557745b88024839ce2

Code Sign

79:78:c8:56:2e:5e:34:91:42:34:0e:a0:ee:ea:c8:78
Certificate

Issuer

CN=NGO

Not Before

14/10/2023, 12:02

Not After

31/12/2039, 23:59

Subject

CN=NGO

Extended Key Usages

ExtKeyUsageCodeSigning

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4d
Signer

Actual PE Digest

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltObjectDereference

ndis.sys

NdisGetVersion

ksecdd.sys

SecLookupAccountSid

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 469KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.[}w
Size: - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sI:
Size: - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vlizer
Size: - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.`?]
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.*u1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uiM
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3dee97d4282ee557745b88024839ce2

Code Sign

79:78:c8:56:2e:5e:34:91:42:34:0e:a0:ee:ea:c8:78Certificate

Extended Key Usages

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4dSigner

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ndis.sys

ksecdd.sys

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 469KB

.rdata Size: - Virtual size: 17KB

.data Size: - Virtual size: 56KB

.pdata Size: - Virtual size: 7KB

INIT Size: - Virtual size: 8KB

.[}w Size: - Virtual size: 768B

.sI: Size: - Virtual size: 72B

.vlizer Size: - Virtual size: 600KB

.`?] Size: - Virtual size: 5.5MB

.*u1 Size: 2KB - Virtual size: 2KB

.uiM Size: 6.9MB - Virtual size: 6.9MB

.reloc Size: 512B - Virtual size: 112B

.rsrc Size: 1024B - Virtual size: 760B

79:78:c8:56:2e:5e:34:91:42:34:0e:a0:ee:ea:c8:78
Certificate

42:55:d8:63:00:28:22:c3:14:2d:a8:00:3d:7e:3e:04:f7:36:57:4d
Signer

.text
Size: - Virtual size: 469KB

.rdata
Size: - Virtual size: 17KB

.data
Size: - Virtual size: 56KB

.pdata
Size: - Virtual size: 7KB

INIT
Size: - Virtual size: 8KB

.[}w
Size: - Virtual size: 768B

.sI:
Size: - Virtual size: 72B

.vlizer
Size: - Virtual size: 600KB

.`?]
Size: - Virtual size: 5.5MB

.*u1
Size: 2KB - Virtual size: 2KB

.uiM
Size: 6.9MB - Virtual size: 6.9MB

.reloc
Size: 512B - Virtual size: 112B

.rsrc
Size: 1024B - Virtual size: 760B