T7ZjLEhV[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

T7ZjLEhV.sys
Size

2.1MB
MD5

ff7642fd946e915caace924effc3b85b
SHA1

e5a808e792b1f7315175612ffd2af8481d614c05
SHA256

fbdf92118c57786f44aac51d136a755d9bf9992b23af97779e2edc963f73894c
SHA512

af70ae16217d9b34f9709ff7627b2a55f1b438d543f6a84b611a65b1f7a870983f5359efbab2cdc112352d39da820b1deb73f7b0aa4fe2790346ca1f6d159afd
SSDEEP

24576:6PhpAQ742Z3JT3wODWlW9f2/MzpjnijarIqJ2I:uLA6Z3JTFDOgxNJh

Score

1^/10

Malware Config

Signatures

Files

T7ZjLEhV.sys
.dll windows:6 windows x64 arch:x64

92247fb3f1a39a572d9cc9b488c21c3b

Code Sign

33:00:00:00:61:c8:8b:12:9c:2a:7f:1d:87:00:00:00:00:00:61
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:f6:de:77:35:13:b8:e9:45:cc:ef:8b:b7:64:70:3b:c3:73:4a:65:3c:ca:da:d0:69:d0:ae:c0:84:08:9b:98
Signer

Actual PE Digest

05:f6:de:77:35:13:b8:e9:45:cc:ef:8b:b7:64:70:3b:c3:73:4a:65:3c:ca:da:d0:69:d0:ae:c0:84:08:9b:98

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Buildbot\s-windows-64\build\release\app-64\win_driver\driver.pdb

Imports

ntoskrnl.exe

ZwQueryVirtualMemory
KeAttachProcess
PsSuspendProcess
PsResumeProcess
KeDetachProcess
ObfDereferenceObject
PsLookupProcessByProcessId
ZwProtectVirtualMemory
__C_specific_handler
wcslen
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ExFreePoolWithTag
MmGetVirtualForPhysical
ExAllocatePoolWithTag

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92247fb3f1a39a572d9cc9b488c21c3b

Code Sign

33:00:00:00:61:c8:8b:12:9c:2a:7f:1d:87:00:00:00:00:00:61Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

05:f6:de:77:35:13:b8:e9:45:cc:ef:8b:b7:64:70:3b:c3:73:4a:65:3c:ca:da:d0:69:d0:ae:c0:84:08:9b:98Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 40KB - Virtual size: 40KB

.pdata Size: 512B - Virtual size: 324B

33:00:00:00:61:c8:8b:12:9c:2a:7f:1d:87:00:00:00:00:00:61
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

05:f6:de:77:35:13:b8:e9:45:cc:ef:8b:b7:64:70:3b:c3:73:4a:65:3c:ca:da:d0:69:d0:ae:c0:84:08:9b:98
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 40KB

.pdata
Size: 512B - Virtual size: 324B