a62e4f2461204bd8234c62c0d909d49c78846f68bdeb00020d4012fa8138d5e0

Sharing

Copy URL Twitter E-mail

General

Target

a62e4f2461204bd8234c62c0d909d49c78846f68bdeb00020d4012fa8138d5e0
Size

59KB
MD5

bacbd65085d20b4d83994f8ece1e8c6a
SHA1

94318a456965ccaa2dce2f4dfe8135c68d79f9fb
SHA256

a62e4f2461204bd8234c62c0d909d49c78846f68bdeb00020d4012fa8138d5e0
SHA512

ecf3cd1403f6e294518efac98464c94c130cf800fd77486811de6a9c3e665fbb8d144a52dda88ccd16a2880a622e0e1c154591f1aaeb134af094cf525593f98d
SSDEEP

768:9vxN8KyNCdCBLL2/05e8wmZbKsdo/Y3JVhT9hbLrqVdu6WBYK:9pCKU/Bt8mJnZBqBo

Score

1^/10

Malware Config

Signatures

Files

a62e4f2461204bd8234c62c0d909d49c78846f68bdeb00020d4012fa8138d5e0
.sys windows:10 windows x64

6847a3e2b05004806d65e2de1e27fbde

Code Sign

34:cc:3e:f6:ae:3f:2b:98:41:3a:49:66:ca:8e:1e:90
Certificate

Issuer

CN=WDKTestCert szx\,133437101106103988

Not Before

06/11/2023, 02:08

Not After

06/11/2033, 00:00

Subject

CN=WDKTestCert szx\,133437101106103988

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

cf:26:50:55:58:f8:eb:ee:74:93:bc:5a:c5:98:f8:2f:e2:07:5d:bb
Signer

Actual PE Digest

cf:26:50:55:58:f8:eb:ee:74:93:bc:5a:c5:98:f8:2f:e2:07:5d:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

KeBugCheckEx
atol
IoWMIRegistrationControl
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlInitUnicodeString
MmUnmapIoSpace
MmMapIoSpace
DbgPrint

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6847a3e2b05004806d65e2de1e27fbde

Code Sign

34:cc:3e:f6:ae:3f:2b:98:41:3a:49:66:ca:8e:1e:90Certificate

Extended Key Usages

Key Usages

cf:26:50:55:58:f8:eb:ee:74:93:bc:5a:c5:98:f8:2f:e2:07:5d:bbSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1.7MB

.pdata Size: 3KB - Virtual size: 2KB

PAGE Size: 3KB - Virtual size: 2KB

INIT Size: 1024B - Virtual size: 996B

.reloc Size: 512B - Virtual size: 40B

34:cc:3e:f6:ae:3f:2b:98:41:3a:49:66:ca:8e:1e:90
Certificate

cf:26:50:55:58:f8:eb:ee:74:93:bc:5a:c5:98:f8:2f:e2:07:5d:bb
Signer

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1.7MB

.pdata
Size: 3KB - Virtual size: 2KB

PAGE
Size: 3KB - Virtual size: 2KB

INIT
Size: 1024B - Virtual size: 996B

.reloc
Size: 512B - Virtual size: 40B