6b6772aa8b08b675ae9392378b8b931243e9587c5e682196ecb17aba4a98b456

Sharing

Copy URL Twitter E-mail

General

Target

6b6772aa8b08b675ae9392378b8b931243e9587c5e682196ecb17aba4a98b456
Size

43KB
MD5

ba3fada40962a7ea8507614f82db7125
SHA1

42aec87c94bb73e505d29ba1db281b86317404db
SHA256

6b6772aa8b08b675ae9392378b8b931243e9587c5e682196ecb17aba4a98b456
SHA512

2a965417536d12e9b605dc96ed94d1c49db35691cbaac80cad2f0389df06110e1190020f9b931df1ae5de79989ce9b35ca42d4a3ec4ea5f6ca6d0402cf7215c2
SSDEEP

768:lORmorb6WgyT+vo742sQhtyMD8+qA1g2xf+h:dab6WgyT+vo74ynyMXqAZ4h

Score

1^/10

Malware Config

Signatures

Files

6b6772aa8b08b675ae9392378b8b931243e9587c5e682196ecb17aba4a98b456
.sys windows:10 windows x64 arch:x64

079e84898cf672f7f86f285242ba2396

Code Sign

79:be:be:6d:71:20:e4:b6:46:98:05:ff:96:44:54:95
Certificate

Issuer

CN=WDKTestCert leexy\,132487766893388247

Not Before

02/11/2020, 07:44

Not After

02/11/2030, 00:00

Subject

CN=WDKTestCert leexy\,132487766893388247

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

2d:2f:25:b5:10:a0:0d:8f:b1:4a:d7:70:93:4b:a4:cf:8f:bf:32:02
Signer

Actual PE Digest

2d:2f:25:b5:10:a0:0d:8f:b1:4a:d7:70:93:4b:a4:cf:8f:bf:32:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\vcwork\ecard_wdf_driver\x64\Debug\WinEncDriver.pdb

Imports

ntoskrnl.exe

KeInitializeSemaphore
KeReleaseSemaphore
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
MmMapIoSpace
RtlInitUnicodeString
MmGetSystemRoutineAddress
ExAllocatePoolWithTag
IoFreeMdl
IoWMIRegistrationControl
KeInitializeSpinLock
KeWaitForSingleObject
KeSetEvent
MmUnlockPages
ExInterlockedRemoveHeadList
ExInterlockedInsertTailList
ExFreePoolWithTag
RtlCopyUnicodeString
DbgPrintEx
KeClearEvent
KeInitializeEvent
DbgPrint

hal

KeStallExecutionProcessor

wpprecorder.sys

WppAutoLogStop
WppAutoLogStart
WppAutoLogTrace
imp_WppRecorderReplay

wdfldr.sys

WdfVersionBind
WdfVersionUnbind
WdfVersionUnbindClass
WdfVersionBindClass

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

079e84898cf672f7f86f285242ba2396

Code Sign

79:be:be:6d:71:20:e4:b6:46:98:05:ff:96:44:54:95Certificate

Extended Key Usages

Key Usages

2d:2f:25:b5:10:a0:0d:8f:b1:4a:d7:70:93:4b:a4:cf:8f:bf:32:02Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

wpprecorder.sys

wdfldr.sys

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

PAGE Size: 7KB - Virtual size: 7KB

INIT Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 56B

79:be:be:6d:71:20:e4:b6:46:98:05:ff:96:44:54:95
Certificate

2d:2f:25:b5:10:a0:0d:8f:b1:4a:d7:70:93:4b:a4:cf:8f:bf:32:02
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

PAGE
Size: 7KB - Virtual size: 7KB

INIT
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 56B