d65278758e57ff60edd0302fcdb1bb9fcf41cc61bcaed77ba5c0edd6b5c20ee3

Sharing

Copy URL Twitter E-mail

General

Target

d65278758e57ff60edd0302fcdb1bb9fcf41cc61bcaed77ba5c0edd6b5c20ee3
Size

7.4MB
MD5

e9e0d7c27fa8198415028b19de05508d
SHA1

28a7f7057e1b86d8c72d9194fc868e9f82c28def
SHA256

d65278758e57ff60edd0302fcdb1bb9fcf41cc61bcaed77ba5c0edd6b5c20ee3
SHA512

9742d9f712b8374b3d911b813d0acee50293ffb707768316debbcd240d154d85954f8e15cf3c4c0c3441ba6e88343defe214f42d22c043d8adbff47f86e40efa
SSDEEP

196608:xIzNZJ8pw/AKa/AZs0kr/zSXz3uRx3mt7F1weQkpRA5NwxlVsx:xIzDxAKa9SXzeRx3CQkPSl

Score

1^/10

Malware Config

Signatures

Files

d65278758e57ff60edd0302fcdb1bb9fcf41cc61bcaed77ba5c0edd6b5c20ee3
.sys windows:10 windows x64 arch:x64

e3dee97d4282ee557745b88024839ce2

Code Sign

5e:68:f2:80:02:9e:4c:b1:44:7c:26:d8:2d:ea:8e:fd
Certificate

Issuer

CN=NGO

Not Before

02/05/2024, 04:18

Not After

31/12/2039, 23:59

Subject

CN=NGO

Extended Key Usages

ExtKeyUsageCodeSigning

68:27:48:40:21:ad:ac:36:d8:e0:ac:14:0a:87:50:12:11:6f:53:27
Signer

Actual PE Digest

68:27:48:40:21:ad:ac:36:d8:e0:ac:14:0a:87:50:12:11:6f:53:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltObjectDereference

ndis.sys

NdisGetVersion

ksecdd.sys

SecLookupAccountSid

ntoskrnl.exe

ExFreePoolWithTag
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wKp
Size: - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.X?g
Size: - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vlizer
Size: - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HVJ
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.>;'
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Xlc
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3dee97d4282ee557745b88024839ce2

Code Sign

5e:68:f2:80:02:9e:4c:b1:44:7c:26:d8:2d:ea:8e:fdCertificate

Extended Key Usages

68:27:48:40:21:ad:ac:36:d8:e0:ac:14:0a:87:50:12:11:6f:53:27Signer

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ndis.sys

ksecdd.sys

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 473KB

.rdata Size: - Virtual size: 17KB

.data Size: - Virtual size: 56KB

.pdata Size: - Virtual size: 7KB

INIT Size: - Virtual size: 8KB

.wKp Size: - Virtual size: 768B

.X?g Size: - Virtual size: 72B

.vlizer Size: - Virtual size: 600KB

.HVJ Size: - Virtual size: 5.8MB

.>;' Size: 2KB - Virtual size: 2KB

.Xlc Size: 7.4MB - Virtual size: 7.4MB

.reloc Size: 512B - Virtual size: 112B

.rsrc Size: 1024B - Virtual size: 760B

5e:68:f2:80:02:9e:4c:b1:44:7c:26:d8:2d:ea:8e:fd
Certificate

68:27:48:40:21:ad:ac:36:d8:e0:ac:14:0a:87:50:12:11:6f:53:27
Signer

.text
Size: - Virtual size: 473KB

.rdata
Size: - Virtual size: 17KB

.data
Size: - Virtual size: 56KB

.pdata
Size: - Virtual size: 7KB

INIT
Size: - Virtual size: 8KB

.wKp
Size: - Virtual size: 768B

.X?g
Size: - Virtual size: 72B

.vlizer
Size: - Virtual size: 600KB

.HVJ
Size: - Virtual size: 5.8MB

.>;'
Size: 2KB - Virtual size: 2KB

.Xlc
Size: 7.4MB - Virtual size: 7.4MB

.reloc
Size: 512B - Virtual size: 112B

.rsrc
Size: 1024B - Virtual size: 760B