941171a39932727002ce80468368c28d0eb14c3d6d250debda25e6ab9ef436e1

Sharing

Copy URL Twitter E-mail

General

Target

941171a39932727002ce80468368c28d0eb14c3d6d250debda25e6ab9ef436e1
Size

10KB
MD5

42009fce46150ff8ebcb3d2039109ef3
SHA1

30e7221f596cd9b7dd2d6b0cdff12f61f924d2c0
SHA256

941171a39932727002ce80468368c28d0eb14c3d6d250debda25e6ab9ef436e1
SHA512

db45b4a831914d3557b861ce4e234634284fc5959fd0d1c751f5c1d3f80e1622198fa86f0c49fd4384e052b403d1ec0573aab4454d44a48066fb92c197857f11
SSDEEP

96:ByPFGwHcYrIXTqzYWOBnrVZ4CKnJ4G4a2cw7fNgKcomKLw4n0yA0KLyzMsAl4cKy:MPQFqIXTqcl7bFgKcjT5SQXl4cKHvO/

Score

1^/10

Malware Config

Signatures

Files

941171a39932727002ce80468368c28d0eb14c3d6d250debda25e6ab9ef436e1
.sys windows:10 windows x64 arch:x64

7c93270704f03df2c3e8d2fad9984992

Code Sign

78:1a:b7:0d:0d:38:7d:94:4f:a0:23:bd:07:4d:e0:cb
Certificate

Issuer

CN=WDKTestCert qu\,132615169463389702

Not Before

29/03/2021, 18:42

Not After

29/03/2031, 00:00

Subject

CN=WDKTestCert qu\,132615169463389702

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

a8:43:4a:f6:cb:04:fe:0f:f2:fe:ee:ef:c2:db:e3:59:88:33:3e:07
Signer

Actual PE Digest

a8:43:4a:f6:cb:04:fe:0f:f2:fe:ee:ef:c2:db:e3:59:88:33:3e:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoDeleteDevice
IoCreateDevice
RtlInitUnicodeString
RtlCopyUnicodeString
DbgPrintEx
IofCompleteRequest
ExAllocatePoolWithTag
DbgPrint
IoDeleteSymbolicLink

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
WdfVersionUnbindClass

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 554B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c93270704f03df2c3e8d2fad9984992

Code Sign

78:1a:b7:0d:0d:38:7d:94:4f:a0:23:bd:07:4d:e0:cbCertificate

Extended Key Usages

Key Usages

a8:43:4a:f6:cb:04:fe:0f:f2:fe:ee:ef:c2:db:e3:59:88:33:3e:07Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

wdfldr.sys

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 712B

.pdata Size: 512B - Virtual size: 192B

INIT Size: 1024B - Virtual size: 554B

.reloc Size: 512B - Virtual size: 36B

78:1a:b7:0d:0d:38:7d:94:4f:a0:23:bd:07:4d:e0:cb
Certificate

a8:43:4a:f6:cb:04:fe:0f:f2:fe:ee:ef:c2:db:e3:59:88:33:3e:07
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 712B

.pdata
Size: 512B - Virtual size: 192B

INIT
Size: 1024B - Virtual size: 554B

.reloc
Size: 512B - Virtual size: 36B