kdstub[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

kdstub.dll
Size

27KB
MD5

e843a86cfe9fca2f82db25588497e779
SHA1

a22be76024ce09731550a62ffba072cb351fba74
SHA256

91d91d935b11cc05701b7cf79b5ef4f8781fec45b5660e0a8055cb591fef4a90
SHA512

d0232d38be14a1109cf6777b1828f512db161e9961efab3fa7cc18de5f2b03f2c04a3513e12c20772b869993d2e00fd87a1758707cc847dec546390c5dd2e316
SSDEEP

384:xDVJ5lrxO/V4aMxTrxKolllHp7Wr2WApDBRJiZUR9zsfFdo:15lctvCTrxKol3HpsIp1Pi29zMo

Score

1^/10

Malware Config

Signatures

Files

kdstub.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:69:18:e9:c6:fe:23:54:b7:38:73:ac:0a:40:61:2e:f4:67:23:9f:fb:93:26:58:c4:bf:2f:e8:ed:80:4d:c9
Signer

Actual PE Digest

90:69:18:e9:c6:fe:23:54:b7:38:73:ac:0a:40:61:2e:f4:67:23:9f:fb:93:26:58:c4:bf:2f:e8:ed:80:4d:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

kdstub.pdb

Exports

Exports

KdInitializeLibrary

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 81B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 54B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

90:69:18:e9:c6:fe:23:54:b7:38:73:ac:0a:40:61:2e:f4:67:23:9f:fb:93:26:58:c4:bf:2f:e8:ed:80:4d:c9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 312B

.pdata Size: 512B - Virtual size: 444B

.00cfg Size: 512B - Virtual size: 16B

.edata Size: 512B - Virtual size: 81B

INIT Size: 512B - Virtual size: 54B

GFIDS Size: 512B - Virtual size: 60B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 248B

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

90:69:18:e9:c6:fe:23:54:b7:38:73:ac:0a:40:61:2e:f4:67:23:9f:fb:93:26:58:c4:bf:2f:e8:ed:80:4d:c9
Signer

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 312B

.pdata
Size: 512B - Virtual size: 444B

.00cfg
Size: 512B - Virtual size: 16B

.edata
Size: 512B - Virtual size: 81B

INIT
Size: 512B - Virtual size: 54B

GFIDS
Size: 512B - Virtual size: 60B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 248B