1266046b25cbfd45c0683afe2494f9b321a033be16b4b2aed0e6f8663d08fe41

Sharing

Copy URL Twitter E-mail

General

Target

1266046b25cbfd45c0683afe2494f9b321a033be16b4b2aed0e6f8663d08fe41
Size

8KB
MD5

613dbbbc3f1ed845fa4288bcbfceb7e1
SHA1

6b28dba297bfa17c981a6245a71e1c861ed33056
SHA256

1266046b25cbfd45c0683afe2494f9b321a033be16b4b2aed0e6f8663d08fe41
SHA512

102520d8e124336433d3df431974cd96f38dc6997b280021cca9cd02514fe5c57a9bd331804b7a4f083744a8173b08e8e04dec0ff92045627be6542eadd1f389
SSDEEP

96:SJj9CsjPZmiwbNKXhcyjN9gTuw5lhNutgmtBcYO3a9Bv8zgmVJN:SJjosjBmiwbNKXPjNN0fUtuYOkynV/

Score

1^/10

Malware Config

Signatures

Files

1266046b25cbfd45c0683afe2494f9b321a033be16b4b2aed0e6f8663d08fe41
.sys windows:10 windows x64 arch:x64

2505906f6be2a9d3719a0bbcb320a3e6

Code Sign

10:69:a4:4f:52:8c:6a:a7:48:7e:c9:f0:9d:b4:a1:5c
Certificate

Issuer

CN=WDKTestCert Administrator\,133243737497332964

Not Before

27/03/2023, 06:55

Not After

27/03/2033, 00:00

Subject

CN=WDKTestCert Administrator\,133243737497332964

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

33:eb:73:64:5f:60:0a:f9:9e:13:b8:fb:03:61:01:a4:3b:33:4e:0c:85:6f:6b:dc:16:b6:c4:af:98:9e:65:92
Signer

Actual PE Digest

33:eb:73:64:5f:60:0a:f9:9e:13:b8:fb:03:61:01:a4:3b:33:4e:0c:85:6f:6b:dc:16:b6:c4:af:98:9e:65:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

wcsstr
DbgPrint
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
IoAllocateIrp
IofCallDriver
IoFreeIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
ObfDereferenceObject
ZwOpenFile
ZwClose
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
IoFileObjectType

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 598B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2505906f6be2a9d3719a0bbcb320a3e6

Code Sign

10:69:a4:4f:52:8c:6a:a7:48:7e:c9:f0:9d:b4:a1:5cCertificate

Extended Key Usages

Key Usages

33:eb:73:64:5f:60:0a:f9:9e:13:b8:fb:03:61:01:a4:3b:33:4e:0c:85:6f:6b:dc:16:b6:c4:af:98:9e:65:92Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 16B

.pdata Size: 512B - Virtual size: 144B

INIT Size: 1024B - Virtual size: 598B

.reloc Size: 512B - Virtual size: 36B

10:69:a4:4f:52:8c:6a:a7:48:7e:c9:f0:9d:b4:a1:5c
Certificate

33:eb:73:64:5f:60:0a:f9:9e:13:b8:fb:03:61:01:a4:3b:33:4e:0c:85:6f:6b:dc:16:b6:c4:af:98:9e:65:92
Signer

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 16B

.pdata
Size: 512B - Virtual size: 144B

INIT
Size: 1024B - Virtual size: 598B

.reloc
Size: 512B - Virtual size: 36B