ndis[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ndis.sys
Size

1.4MB
MD5

bb72556dc5eaa22eaae4a9e50bd66bec
SHA1

b13ebe82b8226c45cd360a074e42a52d7087fc75
SHA256

e3bf4f0d0dbd8493d08dd309d69f271b2438040be986d5f5f1b8bbec47ecbd00
SHA512

a0028cb26c964dc59e54cb07d062bc66d9a622520ae6969d9f88fd602eb195d08a8ec0f8100be12fa24c5c8d4a1beb07da63fcc17b6b573551337881d4805845
SSDEEP

24576:LGsxOlkUCbuOyJDTwv7t+/ZJf0Qnn3ozyzQmcx/vfC4qzxYSxsjzdzX0:LGsxOlk5G4+7ftozysmcx/NqzxU

Score

1^/10

Malware Config

Signatures

Files

ndis.sys
.sys windows:10 windows x64 arch:x64

0407be1f01daa0405e82da6d3a5bc251

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:47:5a:ae:72:5f:b4:08:ac:7c:39:74:ed:c8:08:98:f5:11:65:70:c7:cd:81:46:b1:57:a5:ab:fe:ea:6a:e6
Signer

Actual PE Digest

d9:47:5a:ae:72:5f:b4:08:ac:7c:39:74:ed:c8:08:98:f5:11:65:70:c7:cd:81:46:b1:57:a5:ab:fe:ea:6a:e6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

WmiGetClock
KeDelayExecutionThread
KfRaiseIrql
KeLowerIrql
IoOpenDeviceRegistryKey
_vsnwprintf
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlStringFromGUID
RtlFreeUnicodeString
ZwOpenKey
ZwClose
ZwEnumerateKey
RtlEqualUnicodeString
RtlIntegerToUnicodeString
RtlQueryRegistryValuesEx
RtlUnicodeStringToInteger
RtlWriteRegistryValue
RtlCharToInteger
KeInitializeMutex
IoAllocateDriverObjectExtension
MmIsVerifierEnabled
MmIsDriverVerifying
ObfReferenceObject
IoGetDriverObjectExtension
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
MmMapIoSpaceEx
MmUnmapIoSpace
DbgPrintEx
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
IoGetDmaAdapter
HalPrivateDispatchTable
KeRegisterBugCheckCallback
KeDeregisterBugCheckCallback
RtlGUIDFromString
ZwUpdateWnfStateData
PoFxEnableDStateReporting
IoBuildSynchronousFsdRequest
IofCallDriver
IoAttachDeviceToDeviceStack
IoRegisterDeviceInterface
IoDetachDevice
RtlUpcaseUnicodeString
IoWMIWriteEvent
KeReleaseMutex
IoInvalidateDeviceState
KeGetRecommendedSharedDataAlignment
MmIsDriverVerifyingByAddress
DbgPrint
KseQueryDeviceFlags
RtlCheckRegistryKey
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExQueryDepthSList
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
KeQueryHighestNodeNumber
KeGetCurrentProcessorNumberEx
KeSetIdealProcessorThread
KeSetSystemGroupAffinityThread
MmAllocateContiguousNodeMemory
MmGetPhysicalAddress
KeRevertToUserGroupAffinityThread
MmFreeContiguousMemorySpecifyCache
KeInitializeDpc
KeSetImportanceDpc
KeInsertQueueDpc
KeQueryDpcWatchdogInformation
PcwRegister
RtlInitUnicodeString
KeQueryTimeIncrement
RtlQueryFeatureConfiguration
RtlRegisterFeatureConfigurationChangeNotification
RtlQueryFeatureConfigurationChangeStamp
EtwRegister
EtwSetInformation
DbgSetDebugFilterState
ExInitializeResourceLite
ExCreateCallback
ExInitializeNPagedLookasideList
MmSizeOfMdl
IoRegisterBootDriverReinitialization
RtlUnregisterFeatureConfigurationChangeNotification
IoRegisterDriverReinitialization
MmMapLockedPages
__C_specific_handler
ExGetPreviousMode
MmUserProbeAddress
ExRaiseDatatypeMisalignment
RtlIsStateSeparationEnabled
RtlDeleteRegistryValue
RtlAppendUnicodeToString
ZwQueryValueKey
RtlGetVersion
KdDebuggerEnabled
IoGetDeviceProperty
wcsnlen
KeGetProcessorNumberFromIndex
KeSetTargetProcessorDpcEx
IoConnectInterruptEx
IoDisconnectInterruptEx
KeSynchronizeExecution
KeGetProcessorIndexFromNumber
KeExpandKernelStackAndCalloutEx
MmMapLockedPagesSpecifyCache
ExQueueWorkItem
bsearch
ObfDereferenceObject
RtlCreateRegistryKey
RtlCompareUnicodeString
MmUnmapLockedPages
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
IoReleaseCancelSpinLock
ExAllocatePoolWithTagPriority
IoGetAffinityInterrupt
IoSetDeviceInterfaceState
IoWMIRegistrationControl
KeInitializeSemaphore
IoInitializeRemoveLockEx
IoGetDeviceNumaNode
NtQuerySystemInformationEx
ZwAllocateLocallyUniqueId
IoAllocateWorkItem
IoQueueWorkItem
IoFreeWorkItem
IoRegisterPlugPlayNotification
ZwOpenFile
ObReferenceObjectByHandle
IoFileObjectType
IoAcquireCancelSpinLock
KeReadStateEvent
KeWaitForSingleObject
ZwQuerySystemInformation
KeQueryActiveProcessorCountEx
ExAllocateTimer
ExSetTimer
KdDebuggerNotPresent
MmSystemRangeStart
KeQueryLogicalProcessorRelationship
KeQueryMaximumProcessorCountEx
qsort
KeRegisterProcessorChangeCallback
KeQueryNodeActiveAffinity
IoIs32bitProcess
IoCancelIrp
IoOpenDriverRegistryKey
PcwAddInstance
RtlClearAllBits
RtlSetBit
RtlFindClearBitsAndSet
RtlClearBit
KeFlushQueuedDpcs
RtlCreateUnicodeString
PsGetCurrentThreadId
KeQueryTotalCycleTimeThread
KeReleaseSpinLockFromDpcLevel
ZwLoadDriver
IoReleaseRemoveLockEx
PoRequestPowerIrp
IoGetDevicePropertyData
PoSetPowerState
KeQueryUnbiasedInterruptTime
KeResetEvent
IoGetFileObjectGenericMapping
RtlMapGenericMask
RtlLengthRequiredSid
RtlInitializeSid
RtlLengthSid
SeExports
RtlCreateAcl
RtlGetAce
RtlAddAccessAllowedAce
ObGetObjectSecurity
RtlGetDaclSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlSelfRelativeToAbsoluteSD
RtlSetDaclSecurityDescriptor
ObSetSecurityObjectByPointer
ObReleaseObjectSecurity
RtlCreateSecurityDescriptor
RtlLengthSecurityDescriptor
SeSetSecurityDescriptorInfo
SeLockSubjectContext
SeAccessCheck
SeAppendPrivileges
SeFreePrivileges
SeUnlockSubjectContext
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
KseRegisterShim
ExSystemTimeToLocalTime
IoWMIOpenBlock
RtlInitAnsiString
RtlAnsiStringToUnicodeString
IoWMIDeviceObjectToProviderId
MmLockPagableDataSection
MmUnlockPagableImageSection
MmLockPagableSectionByHandle
RtlCompareUnicodeStrings
ExAllocatePool2
KeReleaseSemaphore
RtlInitializeBitMap
RtlSetBits
RtlPrefixUnicodeString
ExNotifyCallback
PsCreateSystemThread
PsThreadType
KeSetPriorityThread
ExDeleteNPagedLookasideList
KeSetTimer
KeTestSpinLock
KeTryToAcquireSpinLockAtDpcLevel
MmFreeMappingAddress
MmAllocateMappingAddress
MmAllocateNodePagesForMdlEx
MmMapLockedPagesWithReservedMapping
MmFreePagesFromMdl
MmGetSystemRoutineAddress
WmiTraceMessageVa
VfQueryDispatchTable
MmAddVerifierThunks
RtlImageDirectoryEntryToData
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
ExInitializeRundownProtection
ExWaitForRundownProtectionRelease
ExReInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
KeInitializeTimer
PoQueryWatchdogTime
KeQueryActiveGroupCount
KeSetActualBasePriorityThread
KeSetTimerEx
vswprintf_s
KeAcquireSpinLockAtDpcLevel
KeSetCoalescableTimer
IofCompleteRequest
KeClearEvent
KeSetEvent
KeCancelTimer
EtwWrite
RtlInt64ToUnicodeString
ExFreePoolWithTag
KeInitializeEvent
KeInitializeSpinLock
ExAllocatePoolWithTag
PoRegisterPowerSettingCallback
ExSubscribeWnfStateChange
ZwPowerInformation
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
IoFreeIrp
ZwDeleteValueKey
ZwSetValueKey
ExAcquirePushLockExclusiveEx
ExReleasePushLockExclusiveEx
ExAcquirePushLockSharedEx
ExReleasePushLockEx
swprintf_s
_wcsnicmp
ZwUnloadDriver
ExReleaseRundownProtectionEx
ExFreePool
IoBuildPartialMdl
ExDeleteLookasideListEx
ExInitializeLookasideListEx
InitializeSListHead
PsGetJobSessionId
PsJobType
PsGetJobProperty
PsSetJobProperty
PsGetProcessJob
SeQueryInformationToken
PsGetProcessSessionId
PsGetThreadProperty
PsGetCurrentProcessSessionId
PsSetThreadProperty
PsReferenceImpersonationToken
PsGetThreadSessionId
PsDereferenceImpersonationToken
ExUuidCreate
RtlRunOnceInitialize
RtlRunOnceExecuteOnce
PsGetCurrentProcess
ObCreateObject
ObCreateObjectType
RtlCompareMemory
RtlTestBitEx
RtlSetBitEx
RtlFindClearBitsAndSetEx
RtlClearBitEx
RtlInitializeBitMapEx
ExInterlockedInsertHeadList
ExInterlockedAddLargeInteger
KeQueryMaximumGroupCount
RtlNumberOfSetBitsUlongPtr
KeQueryGroupAffinity
MmFreeNonCachedMemory
MmAllocateNonCachedMemory
ZwReadFile
ZwCreateFile
ZwQueryInformationFile
ExGetCurrentProcessorCpuUsage
KeInitializeTimerEx
ExGetCurrentProcessorCounts
ExInterlockedAddUlong
ExInterlockedInsertTailList
ExInterlockedPopEntryList
ExInterlockedRemoveHeadList
ExInterlockedPushEntryList
RtlFindSetBits
RtlNumberOfSetBits
RtlCreateHashTable
RtlCaptureStackBackTrace
RtlRemoveEntryHashTable
RtlInsertEntryHashTable
RtlLookupEntryHashTable
ObOpenObjectByPointer
IoDeviceObjectType
ZwSetSecurityObject
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
wcschr
_snwprintf
SeCaptureSecurityDescriptor
ZwCreateKey
IoReuseIrp
IoSynchronousCallDriver
IoAllocateIrp
DbgkWerCaptureLiveKernelDump
IoAcquireRemoveLockEx
KeBugCheckEx
ExRundownCompleted
ExWaitForRundownProtectionReleaseCacheAware
ExAcquireRundownProtectionCacheAware
ExAllocateCacheAwareRundownProtection
ExReleaseRundownProtectionCacheAware
ExReInitializeRundownProtectionCacheAware
ExFreeCacheAwareRundownProtection
EtwWriteTransfer
MmFreeContiguousMemory
ExQueryWnfStateData
wcscpy_s
wcscat_s
wcscmp

hal

KeStallExecutionProcessor
HalTranslateBusAddress
KeQueryPerformanceCounter

netio.sys

NmrWaitForProviderDeregisterComplete
NmrRegisterProvider
NsiSetAllParametersEx
NsiEnumerateObjectsAllParametersEx
NsiSetParameterEx
NsiRegisterChangeNotificationEx
WfpNblInfoCleanup
WfpNblInfoClone
NmrClientDetachProviderComplete
NmrClientAttachProvider
NmrRegisterClient
NetioSetTriageBlock
NmrDeregisterProvider
NsiSetObjectSecurity

wpprecorder.sys

imp_WppRecorderReplay
imp_WppRecorderIsDefaultLogAvailable
WppAutoLogTrace
WppAutoLogStart

Exports

Exports

EthFilterDprIndicateReceive
EthFilterDprIndicateReceiveComplete
NDIS_BUFFER_TO_SPAN_PAGES
NdisAcquireRWLockRead
NdisAcquireRWLockWrite
NdisAcquireReadWriteLock
NdisAcquireSpinLock
NdisActiveGroupCount
NdisAdjustBufferLength
NdisAdjustNetBufferCurrentMdl
NdisAdvanceNetBufferDataStart
NdisAdvanceNetBufferListDataStart
NdisAllocateBuffer
NdisAllocateBufferPool
NdisAllocateCloneNetBufferList
NdisAllocateCloneOidRequest
NdisAllocateFragmentNetBufferList
NdisAllocateGenericObject
NdisAllocateIoWorkItem
NdisAllocateMdl
NdisAllocateMemory
NdisAllocateMemoryWithTag
NdisAllocateMemoryWithTagPriority
NdisAllocateNetBuffer
NdisAllocateNetBufferAndNetBufferList
NdisAllocateNetBufferList
NdisAllocateNetBufferListContext
NdisAllocateNetBufferListPool
NdisAllocateNetBufferMdlAndData
NdisAllocateNetBufferPool
NdisAllocatePacket
NdisAllocatePacketPool
NdisAllocatePacketPoolEx
NdisAllocateRWLock
NdisAllocateReassembledNetBufferList
NdisAllocateRefCount
NdisAllocateSharedMemory
NdisAllocateSpinLock
NdisAllocateTimerObject
NdisAnsiStringToUnicodeString
NdisBufferLength
NdisBufferVirtualAddress
NdisBuildScatterGatherList
NdisCancelDirectOidRequest
NdisCancelOidRequest
NdisCancelSendNetBufferLists
NdisCancelSendPackets
NdisCancelTimer
NdisCancelTimerObject
NdisClAddParty
NdisClCloseAddressFamily
NdisClCloseCall
NdisClDeregisterSap
NdisClDropParty
NdisClGetProtocolVcContextFromTapiCallId
NdisClIncomingCallComplete
NdisClMakeCall
NdisClModifyCallQoS
NdisClNotifyCloseAddressFamilyComplete
NdisClOpenAddressFamily
NdisClOpenAddressFamilyEx
NdisClRegisterSap
NdisCloseAdapter
NdisCloseAdapterEx
NdisCloseConfiguration
NdisCloseFile
NdisCloseNDKAdapter
NdisCmActivateVc
NdisCmAddPartyComplete
NdisCmCloseAddressFamilyComplete
NdisCmCloseCallComplete
NdisCmDeactivateVc
NdisCmDeregisterSapComplete
NdisCmDispatchCallConnected
NdisCmDispatchIncomingCall
NdisCmDispatchIncomingCallQoSChange
NdisCmDispatchIncomingCloseCall
NdisCmDispatchIncomingDropParty
NdisCmDropPartyComplete
NdisCmMakeCallComplete
NdisCmModifyCallQoSComplete
NdisCmNotifyCloseAddressFamily
NdisCmOpenAddressFamilyComplete
NdisCmRegisterAddressFamily
NdisCmRegisterAddressFamilyEx
NdisCmRegisterSapComplete
NdisCoAssignInstanceName
NdisCoCreateVc
NdisCoDeleteVc
NdisCoGetTapiCallId
NdisCoOidRequest
NdisCoOidRequestComplete
NdisCoRequest
NdisCoRequestComplete
NdisCoSendNetBufferLists
NdisCoSendPackets
NdisCompareAnsiString
NdisCompareUnicodeString
NdisCompleteBindAdapter
NdisCompleteBindAdapterEx
NdisCompleteDmaTransfer
NdisCompleteNetPnPEvent
NdisCompletePnPEvent
NdisCompleteUnbindAdapter
NdisCompleteUnbindAdapterEx
NdisConvertNdisStatusToNtStatus
NdisConvertNtStatusToNdisStatus
NdisCopyBuffer
NdisCopyFromNetBufferToNetBuffer
NdisCopyFromPacketToPacket
NdisCopyFromPacketToPacketSafe
NdisCopyReceiveNetBufferListInfo
NdisCopySendNetBufferListInfo
NdisCurrentGroupAndProcessor
NdisCurrentProcessorIndex
NdisDereferenceWithTag
NdisDeregisterDeviceEx
NdisDeregisterProtocol
NdisDeregisterProtocolDriver
NdisDeregisterTdiCallBack
NdisDirectOidRequest
NdisDllInitialize
NdisDprAcquireReadWriteLock
NdisDprAcquireSpinLock
NdisDprAllocatePacket
NdisDprAllocatePacketNonInterlocked
NdisDprFreePacket
NdisDprFreePacketNonInterlocked
NdisDprReleaseReadWriteLock
NdisDprReleaseSpinLock
NdisEnumerateFilterModules
NdisEqualString
NdisFCancelDirectOidRequest
NdisFCancelOidRequest
NdisFCancelSendNetBufferLists
NdisFDeregisterFilterDriver
NdisFDevicePnPEventNotify
NdisFDirectOidRequest
NdisFDirectOidRequestComplete
NdisFGetOptionalSwitchHandlers
NdisFIndicateReceiveNetBufferLists
NdisFIndicateStatus
NdisFNetPnPEvent
NdisFOidRequest
NdisFOidRequestComplete
NdisFPauseComplete
NdisFRegisterFilterDriver
NdisFRestartComplete
NdisFRestartFilter
NdisFRetryAttach
NdisFReturnNetBufferLists
NdisFSendNetBufferLists
NdisFSendNetBufferListsComplete
NdisFSetAttributes
NdisFSynchronousOidRequest
NdisFreeBuffer
NdisFreeBufferPool
NdisFreeCloneNetBufferList
NdisFreeCloneOidRequest
NdisFreeFragmentNetBufferList
NdisFreeGenericObject
NdisFreeIoWorkItem
NdisFreeMdl
NdisFreeMemory
NdisFreeMemoryWithTag
NdisFreeMemoryWithTagPriority
NdisFreeNetBuffer
NdisFreeNetBufferList
NdisFreeNetBufferListContext
NdisFreeNetBufferListPool
NdisFreeNetBufferPool
NdisFreePacket
NdisFreePacketPool
NdisFreeRWLock
NdisFreeReassembledNetBufferList
NdisFreeRefCount
NdisFreeScatterGatherList
NdisFreeSharedMemory
NdisFreeSpinLock
NdisFreeTimerObject
NdisGeneratePartialCancelId
NdisGetAndReferenceCompartmentJobObject
NdisGetBufferPhysicalArraySize
NdisGetCurrentProcessorCounts
NdisGetCurrentProcessorCpuUsage
NdisGetCurrentSystemTime
NdisGetDataBuffer
NdisGetDeviceReservedExtension
NdisGetDriverHandle
NdisGetFirstBufferFromPacket
NdisGetFirstBufferFromPacketSafe
NdisGetHypervisorInfo
NdisGetJobObjectCompartmentId
NdisGetNetBufferListProtocolId
NdisGetPacketCancelId
NdisGetPacketFromNetBufferList
NdisGetPoolFromNetBuffer
NdisGetPoolFromNetBufferList
NdisGetPoolFromPacket
NdisGetProcessObjectCompartmentId
NdisGetProcessorInformation
NdisGetProcessorInformationEx
NdisGetReceivedPacket
NdisGetRefCount
NdisGetRoutineAddress
NdisGetRssProcessorInformation
NdisGetSessionCompartmentId
NdisGetSessionToCompartmentMappingEpochAndZero
NdisGetSharedDataAlignment
NdisGetSystemUpTime
NdisGetSystemUpTimeEx
NdisGetThreadObjectCompartmentId
NdisGetThreadObjectCompartmentScope
NdisGetVersion
NdisGroupActiveProcessorCount
NdisGroupActiveProcessorMask
NdisGroupMaxProcessorCount
NdisIMAssociateMiniport
NdisIMCancelInitializeDeviceInstance
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisIMDeInitializeDeviceInstance
NdisIMDeregisterLayeredMiniport
NdisIMGetBindingContext
NdisIMGetCurrentPacketStack
NdisIMGetDeviceContext
NdisIMInitializeDeviceInstance
NdisIMInitializeDeviceInstanceEx
NdisIMNotifyPnPEvent
NdisIMQueueMiniportCallback
NdisIMRegisterLayeredMiniport
NdisIMRevertBack
NdisIMSwitchToMiniport
NdisIMVBusDeviceAdd
NdisIMVBusDeviceRemove
NdisIfAddIfStackEntry
NdisIfAllocateNetLuidIndex
NdisIfAllocateNetLuidIndexEx
NdisIfDeleteIfStackEntry
NdisIfDeregisterInterface
NdisIfDeregisterProvider
NdisIfFreeNetLuidIndex
NdisIfGetInterfaceIndexFromNetLuid
NdisIfGetNetLuidFromInterfaceIndex
NdisIfQueryBindingIfIndex
NdisIfRegisterInterface
NdisIfRegisterProvider
NdisImmediateReadPciSlotInformation
NdisImmediateReadPortUchar
NdisImmediateReadPortUlong
NdisImmediateReadPortUshort
NdisImmediateReadSharedMemory
NdisImmediateWritePciSlotInformation
NdisImmediateWritePortUchar
NdisImmediateWritePortUlong
NdisImmediateWritePortUshort
NdisImmediateWriteSharedMemory
NdisInitAnsiString
NdisInitUnicodeString
NdisInitializeEvent
NdisInitializeReadWriteLock
NdisInitializeString
NdisInitializeTimer
NdisInitializeWrapper
NdisInitiateOffload
NdisInterlockedAddLargeInterger
NdisInterlockedAddUlong
NdisInterlockedDecrement
NdisInterlockedIncrement
NdisInterlockedInsertHeadList
NdisInterlockedInsertTailList
NdisInterlockedPopEntryList
NdisInterlockedPushEntryList
NdisInterlockedRemoveHeadList
NdisInvalidateOffload
NdisIsStatusIndicationCloneable
NdisLWMDeregisterMiniportDriver
NdisLWMInitializeNetworkInterface
NdisLWMRegisterMiniportDriver
NdisLWMStartNetworkInterface
NdisLWMUninitializeNetworkInterface
NdisMAllocateMapRegisters
NdisMAllocateNetBufferSGList
NdisMAllocatePort
NdisMAllocateSharedMemory
NdisMAllocateSharedMemoryAsync
NdisMAllocateSharedMemoryAsyncEx
NdisMCancelTimer
NdisMCloseLog
NdisMCmActivateVc
NdisMCmCreateVc
NdisMCmDeactivateVc
NdisMCmDeleteVc
NdisMCmOidRequest
NdisMCmRegisterAddressFamily
NdisMCmRegisterAddressFamilyEx
NdisMCmRequest
NdisMCoActivateVcComplete
NdisMCoDeactivateVcComplete
NdisMCoIndicateReceiveNetBufferLists
NdisMCoIndicateReceivePacket
NdisMCoIndicateStatus
NdisMCoIndicateStatusEx
NdisMCoOidRequestComplete
NdisMCoReceiveComplete
NdisMCoRequestComplete
NdisMCoSendComplete
NdisMCoSendNetBufferListsComplete
NdisMCompleteBufferPhysicalMapping
NdisMConfigMSIXTableEntry
NdisMCreateLog
NdisMDeregisterAdapterShutdownHandler
NdisMDeregisterDevice
NdisMDeregisterDmaChannel
NdisMDeregisterInterrupt
NdisMDeregisterInterruptEx
NdisMDeregisterIoPortRange
NdisMDeregisterMiniportDriver
NdisMDeregisterScatterGatherDma
NdisMDeregisterWdiMiniportDriver
NdisMDirectOidRequestComplete
NdisMEnableVirtualization
NdisMFlushLog
NdisMFreeMapRegisters
NdisMFreeNetBufferSGList
NdisMFreePort
NdisMFreeSharedMemory
NdisMGetBusData
NdisMGetDeviceProperty
NdisMGetDmaAlignment
NdisMGetMiniportInitAttributes
NdisMGetOffloadHandlers
NdisMGetVirtualDeviceLocation
NdisMGetVirtualFunctionBusData
NdisMGetVirtualFunctionLocation
NdisMIdleNotificationComplete
NdisMIdleNotificationCompleteEx
NdisMIdleNotificationConfirm
NdisMIndicateReceiveNetBufferLists
NdisMIndicateStatus
NdisMIndicateStatusComplete
NdisMIndicateStatusEx
NdisMInitializeScatterGatherDma
NdisMInitializeTimer
NdisMInitiateOffloadComplete
NdisMInvalidateConfigBlock
NdisMInvalidateOffloadComplete
NdisMMapIoSpace
NdisMNetPnPEvent
NdisMOffloadEventIndicate
NdisMOidRequestComplete
NdisMPauseComplete
NdisMPciAssignResources
NdisMPromoteMiniport
NdisMQueryAdapterInstanceName
NdisMQueryAdapterResources
NdisMQueryInformationComplete
NdisMQueryOffloadStateComplete
NdisMQueryProbedBars
NdisMQueueDpc
NdisMQueueDpcEx
NdisMReadConfigBlock
NdisMReadDmaCounter
NdisMReenumerateFailedAdapter
NdisMRegisterAdapterShutdownHandler
NdisMRegisterDevice
NdisMRegisterDmaChannel
NdisMRegisterInterrupt
NdisMRegisterInterruptEx
NdisMRegisterIoPortRange
NdisMRegisterMiniport
NdisMRegisterMiniportDriver
NdisMRegisterScatterGatherDma
NdisMRegisterUnloadHandler
NdisMRegisterWdiMiniportDriver
NdisMRemoveMiniport
NdisMRequestDpc
NdisMResetComplete
NdisMResetMiniport
NdisMRestartComplete
NdisMSendComplete
NdisMSendNetBufferListsComplete
NdisMSendResourcesAvailable
NdisMSetAttributes
NdisMSetAttributesEx
NdisMSetBusData
NdisMSetInformationComplete
NdisMSetInterfaceCompartment
NdisMSetMiniportAttributes
NdisMSetMiniportSecondary
NdisMSetPeriodicTimer
NdisMSetTimer
NdisMSetVirtualFunctionBusData
NdisMSleep
NdisMStartBufferPhysicalMapping
NdisMSynchronizeWithInterrupt
NdisMSynchronizeWithInterruptEx
NdisMTerminateOffloadComplete
NdisMTransferDataComplete
NdisMTriggerPDDrainNotification
NdisMUnmapIoSpace
NdisMUpdateOffloadComplete
NdisMWanIndicateReceive
NdisMWanIndicateReceiveComplete
NdisMWanSendComplete
NdisMWriteConfigBlock
NdisMWriteLogData
NdisMapFile
NdisMatchPdoWithPacket
NdisMaxGroupCount
NdisNblTrackerDeregisterComponent
NdisNblTrackerQueryNblCurrentOwner
NdisNblTrackerRecordEvent
NdisNblTrackerRegisterComponent
NdisNblTrackerTransferOwnership
NdisOffloadTcpDisconnect
NdisOffloadTcpForward
NdisOffloadTcpReceive
NdisOffloadTcpReceiveReturn
NdisOffloadTcpSend
NdisOidRequest
NdisOpenAdapter
NdisOpenAdapterEx
NdisOpenConfiguration
NdisOpenConfigurationEx
NdisOpenConfigurationKeyByIndex
NdisOpenConfigurationKeyByName
NdisOpenFile
NdisOpenNDKAdapter
NdisOpenProtocolConfiguration
NdisOverrideBusNumber
NdisPDStartup
NdisPacketPoolUsage
NdisPacketSize
NdisProcessorIndexToNumber
NdisProcessorNumberToIndex
NdisQueryAdapterInstanceName
NdisQueryBindInstanceName
NdisQueryBuffer
NdisQueryBufferOffset
NdisQueryBufferSafe
NdisQueryDiagnosticSetting
NdisQueryMapRegisterCount
NdisQueryNetBufferPhysicalCount
NdisQueryOffloadState
NdisQueryPendingIOCount
NdisQueueIoWorkItem
NdisReEnumerateProtocolBindings
NdisReadConfiguration
NdisReadEisaSlotInformation
NdisReadEisaSlotInformationEx
NdisReadMcaPosInformation
NdisReadNetworkAddress
NdisReadPciSlotInformation
NdisReadPcmciaAttributeMemory
NdisReferenceWithTag
NdisRegisterDeviceEx
NdisRegisterProtocol
NdisRegisterProtocolDriver
NdisRegisterTdiCallBack
NdisReleaseNicActive
NdisReleaseRWLock
NdisReleaseReadWriteLock
NdisReleaseSpinLock
NdisRequest
NdisRequestEx
NdisReset
NdisResetEvent
NdisRetreatNetBufferDataStart
NdisRetreatNetBufferListDataStart
NdisReturnNetBufferLists
NdisReturnPackets
NdisScheduleWorkItem
NdisSend
NdisSendNetBufferLists
NdisSendPackets
NdisSetAoAcOptions
NdisSetCoalescableTimerObject
NdisSetEvent
NdisSetOptionalHandlers
NdisSetPacketCancelId
NdisSetPacketPoolProtocolId
NdisSetPacketStatus
NdisSetPeriodicTimer
NdisSetProtocolFilter
NdisSetSessionCompartmentId
NdisSetThreadObjectCompartmentId
NdisSetThreadObjectCompartmentScope
NdisSetTimer
NdisSetTimerEx
NdisSetTimerObject
NdisSetupDmaTransfer
NdisSynchronousOidRequest
NdisSystemActiveProcessorCount
NdisSystemProcessorCount
NdisTerminateOffload
NdisTerminateWrapper
NdisTestRWLockHeldByCurrentProcessorRead
NdisTestRWLockHeldByCurrentProcessorWrite
NdisTransferData

Sections

.text
Size: 791KB - Virtual size: 791KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

NONPAGE
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGENPNP
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0407be1f01daa0405e82da6d3a5bc251

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

d9:47:5a:ae:72:5f:b4:08:ac:7c:39:74:ed:c8:08:98:f5:11:65:70:c7:cd:81:46:b1:57:a5:ab:fe:ea:6a:e6Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

netio.sys

wpprecorder.sys

Exports

Exports

Sections

.text Size: 791KB - Virtual size: 791KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 4KB - Virtual size: 12KB

.pdata Size: 47KB - Virtual size: 47KB

.idata Size: 15KB - Virtual size: 15KB

NONPAGE Size: 512B - Virtual size: 176B

PAGE Size: 199KB - Virtual size: 198KB

PAGENPNP Size: 71KB - Virtual size: 70KB

.edata Size: 19KB - Virtual size: 19KB

PAGEDATA Size: 5KB - Virtual size: 5KB

INIT Size: 17KB - Virtual size: 17KB

GFIDS Size: 5KB - Virtual size: 5KB

.rsrc Size: 118KB - Virtual size: 118KB

.reloc Size: 27KB - Virtual size: 26KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

d9:47:5a:ae:72:5f:b4:08:ac:7c:39:74:ed:c8:08:98:f5:11:65:70:c7:cd:81:46:b1:57:a5:ab:fe:ea:6a:e6
Signer

.text
Size: 791KB - Virtual size: 791KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 4KB - Virtual size: 12KB

.pdata
Size: 47KB - Virtual size: 47KB

.idata
Size: 15KB - Virtual size: 15KB

NONPAGE
Size: 512B - Virtual size: 176B

PAGE
Size: 199KB - Virtual size: 198KB

PAGENPNP
Size: 71KB - Virtual size: 70KB

.edata
Size: 19KB - Virtual size: 19KB

PAGEDATA
Size: 5KB - Virtual size: 5KB

INIT
Size: 17KB - Virtual size: 17KB

GFIDS
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 118KB - Virtual size: 118KB

.reloc
Size: 27KB - Virtual size: 26KB