313e0c8056ce05214825cfa2e6b99d18530f0532878df0f6e9e920d49e41d16f

Sharing

Copy URL

Twitter E-mail

General

Target

313e0c8056ce05214825cfa2e6b99d18530f0532878df0f6e9e920d49e41d16f
Size

596KB
MD5

09fb14f31d0a0839253fc96cddae8e7c
SHA1

4a28778f77f3416527a2938a1f759cbf351cf648
SHA256

313e0c8056ce05214825cfa2e6b99d18530f0532878df0f6e9e920d49e41d16f
SHA512

002deb62a2c004e1a53756809c56014e13a556238d9420c082f45dc9746b914de3bd95fe762f1cf70326797bc3e2881f725fa1211a475976dca4db94d2f3f35b
SSDEEP

6144:dQcHlXLLSIN8HQfQ84a4bsXqLcoFurTd7u8q3v9OfmCQAO1I+H6bNwX7Gy82BPkO:dQa8QoSnQvMTVu82Et+19+kPkjK

Score

1^/10

Malware Config

Signatures

Files

313e0c8056ce05214825cfa2e6b99d18530f0532878df0f6e9e920d49e41d16f
.sys windows:10 windows x64 arch:x64

b0f4331c853fe7dcc074d4b544cc1d7b

Code Sign

3a:56:54:c2:d9:62:58:80:46:5a:09:64:1d:41:36:c9
Certificate

Issuer

CN=WDKTestCert artem\,133457294009822282

Not Before

29/11/2023, 11:03

Not After

29/11/2033, 00:00

Subject

CN=WDKTestCert artem\,133457294009822282

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

2e:bc:eb:50:d2:cf:da:33:61:e0:3d:2d:9c:1b:6f:73:0c:fc:7c:54
Signer

Actual PE Digest

2e:bc:eb:50:d2:cf:da:33:61:e0:3d:2d:9c:1b:6f:73:0c:fc:7c:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltUnregisterFilter
FltStartFiltering
FltGetFileNameInformation
FltRegisterFilter
FltEnumerateFilters
FltGetFilterInformation
FltReleaseFileNameInformation
FltGetFileNameInformationUnsafe
FltParseFileName

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
PsCreateSystemThread
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
EtwRegister
EtwUnregister
EtwWriteTransfer
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwOpenKey
RtlGetVersion
RtlUpcaseUnicodeString
MmGetPhysicalAddress
MmIsAddressValid
PsSetLoadImageNotifyRoutine
ZwOpenProcess
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ObOpenObjectByPointer
ZwDuplicateObject
ZwQueryInformationProcess
ZwOpenThread
ObReferenceObjectByName
__C_specific_handler
PsProcessType
IoDriverObjectType
InitSafeBootMode
KeBugCheckEx
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlInitUnicodeString
_wcsicmp
wcsrchr
KeSetPriorityThread
RtlEnumerateGenericTableAvl
KeInitializeEvent
ExAcquireFastMutex
ExReleaseFastMutex
RtlCompareUnicodeString
RtlFreeUnicodeString
ExAllocatePool
MmUnlockPages
IoFreeMdl
KeStackAttachProcess
KeUnstackDetachProcess
ZwQuerySystemInformation
ObReferenceObjectByHandleWithTag
ObfDereferenceObjectWithTag
ZwOpenFile
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
RtlRunOnceInitialize
RtlRunOnceBeginInitialize
RtlRunOnceComplete
PsGetCurrentProcessId
ObMakeTemporaryObject
ZwQuerySecurityObject
RtlImageNtHeader
ZwQuerySection
RtlImageDirectoryEntryToData
PsInitialSystemProcess
wcscpy_s
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExAcquireRundownProtection
ExAcquireRundownProtectionEx
ExReleaseRundownProtection
ExReleaseRundownProtectionEx
CmUnRegisterCallback
PsTerminateSystemThread
IoIs32bitProcess
ObUnRegisterCallbacks
PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutineEx
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
vsprintf_s
PsThreadType
ExDesktopObjectType
vDbgPrintExWithPrefix
PsGetThreadId
PsGetThreadProcessId
KeNumberProcessors
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExInitializeResourceLite
ExDeleteResourceLite
wcsstr
wcsnlen
RtlEqualUnicodeString
ProbeForRead
PsGetCurrentThreadTeb
wcsncat_s
KeSetEvent
KeWaitForSingleObject
ExRaiseStatus
IoAllocateIrp
IofCallDriver
IoCreateFile
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
IoGetFileObjectGenericMapping
ZwDeleteFile
ObCreateObject
SeCreateAccessState
IoFileObjectType
MmMapIoSpace
MmUnmapIoSpace
ZwQueryVirtualMemory
KeClearEvent
ExAllocatePoolWithQuotaTag
ExGetPreviousMode
ObCloseHandle
PsGetProcessId
SeLocateProcessImageName
PsGetThreadProcess
ObInsertObject
PsReferenceProcessFilePointer
ZwFlushInstructionCache
MmUserProbeAddress
ZwCreateKey
ZwDeleteKey
ZwSetValueKey

Sections

.text
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0f4331c853fe7dcc074d4b544cc1d7b

Code Sign

3a:56:54:c2:d9:62:58:80:46:5a:09:64:1d:41:36:c9Certificate

Extended Key Usages

Key Usages

2e:bc:eb:50:d2:cf:da:33:61:e0:3d:2d:9c:1b:6f:73:0c:fc:7c:54Signer

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

Sections

.text Size: 103KB - Virtual size: 102KB

.rdata Size: 472KB - Virtual size: 471KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 3KB - Virtual size: 2KB

PAGE Size: 512B - Virtual size: 340B

INIT Size: 5KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 5KB - Virtual size: 5KB

3a:56:54:c2:d9:62:58:80:46:5a:09:64:1d:41:36:c9
Certificate

2e:bc:eb:50:d2:cf:da:33:61:e0:3d:2d:9c:1b:6f:73:0c:fc:7c:54
Signer

.text
Size: 103KB - Virtual size: 102KB

.rdata
Size: 472KB - Virtual size: 471KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 3KB - Virtual size: 2KB

PAGE
Size: 512B - Virtual size: 340B

INIT
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 5KB - Virtual size: 5KB