ed209f000ed391112c8c9e988e2a987662569666ae6385f9164c22032b6192f6

Sharing

Copy URL Twitter E-mail

General

Target

ed209f000ed391112c8c9e988e2a987662569666ae6385f9164c22032b6192f6
Size

42KB
MD5

4d4d2cc430054700e94f78ab90375319
SHA1

7c38dcefeb0e988c98312afe0ec4cf98fa58b618
SHA256

ed209f000ed391112c8c9e988e2a987662569666ae6385f9164c22032b6192f6
SHA512

7a6bf6b4f881e080334a50ba8cd0b9a40e35a56c602c8ef95d31f55d41e136608a59c65b70f339457f8ecadd6e838073278c5c59dc0d00b5862a52ecd1f15dc6
SSDEEP

768:6m8MVpkmr0qfCfT5NbVd9Qp6aJOr/TFyUVRqFCcj:b8M30VfTfVd9Qp6a20UVRn6

Score

1^/10

Malware Config

Signatures

Files

ed209f000ed391112c8c9e988e2a987662569666ae6385f9164c22032b6192f6
.sys windows:10 windows x64 arch:x64

72d5f15c73658ec3b56416a25bc51bcd

Code Sign

79:be:be:6d:71:20:e4:b6:46:98:05:ff:96:44:54:95
Certificate

Issuer

CN=WDKTestCert leexy\,132487766893388247

Not Before

02/11/2020, 07:44

Not After

02/11/2030, 00:00

Subject

CN=WDKTestCert leexy\,132487766893388247

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

29:92:87:30:b4:0c:e5:f9:70:7e:b6:29:96:d8:be:62:a1:ed:80:43
Signer

Actual PE Digest

29:92:87:30:b4:0c:e5:f9:70:7e:b6:29:96:d8:be:62:a1:ed:80:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ExInterlockedInsertTailList
ExInterlockedRemoveHeadList
MmUnlockPages
IoFreeMdl
KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
MmMapIoSpace
ExFreePoolWithTag
MmGetSystemRoutineAddress
IoWMIRegistrationControl
KeBugCheckEx
ExAllocatePoolWithTag
KeWaitForSingleObject
KeSetEvent
RtlCopyUnicodeString
KeClearEvent
KeInitializeEvent
RtlInitUnicodeString
DbgPrint

hal

KeStallExecutionProcessor

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72d5f15c73658ec3b56416a25bc51bcd

Code Sign

79:be:be:6d:71:20:e4:b6:46:98:05:ff:96:44:54:95Certificate

Extended Key Usages

Key Usages

29:92:87:30:b4:0c:e5:f9:70:7e:b6:29:96:d8:be:62:a1:ed:80:43Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1KB - Virtual size: 1KB

PAGE Size: 8KB - Virtual size: 8KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 48B

79:be:be:6d:71:20:e4:b6:46:98:05:ff:96:44:54:95
Certificate

29:92:87:30:b4:0c:e5:f9:70:7e:b6:29:96:d8:be:62:a1:ed:80:43
Signer

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1KB - Virtual size: 1KB

PAGE
Size: 8KB - Virtual size: 8KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 48B