null[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

null.sys
Size

11KB
MD5

c1a8745d17c35354be341fff75b12b0a
SHA1

ec0aa535a045eb8c35edf75af71c173626c16717
SHA256

3761892ee088bcf038687bf872d0d7ba15152c2dc92c27ff023c888a66b6cd8e
SHA512

ae5bca059d85386cd7a93d26bb3ea24f1164288145f9bd0a29753996c7342c37fe085843c395f4bf743a1f786a5f15da1546e42bae825831f5aa656b62e75dc2
SSDEEP

192:I9SjAQbKsmEc+PbydCSYJXHopbL2oEhZnpH3GCwgEf8qReG2:wsXb5JmdkKpbz8ZpH3GCJEEfG2

Score

1^/10

Malware Config

Signatures

Files

null.sys
.sys windows:10 windows x64 arch:x64

a3fc15df0095a1a39e807fbd1ab75c38

Code Sign

23:a1:f9:dd:52:5e:fd:85:30:3f:63:e8:86:0f:e4:57
Certificate

Issuer

CN=SubZero on Top Certificate Authority

Not Before

23/11/2023, 20:23

Not After

23/11/2053, 20:23

Subject

CN=SubZero on Top

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:35:d7:46:30:4f:c8:a9:48:ec:36:48:71:81:e2:0d
Certificate

Issuer

CN=SubZero on Top Certificate Authority

Not Before

23/11/2023, 20:23

Not After

23/11/2053, 20:23

Subject

CN=SubZero on Top Certificate Authority

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

83:0b:bc:9e:5b:23:d2:03:54:22:ef:8c:04:dc:ca:59:c7:da:18:3b
Signer

Actual PE Digest

83:0b:bc:9e:5b:23:d2:03:54:22:ef:8c:04:dc:ca:59:c7:da:18:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\nicov\OneDrive\Desktop\Spoofer Source\Driver\build\bin\Premium.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType
strstr
ZwQuerySystemInformation

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a3fc15df0095a1a39e807fbd1ab75c38

Code Sign

23:a1:f9:dd:52:5e:fd:85:30:3f:63:e8:86:0f:e4:57Certificate

Extended Key Usages

Key Usages

4c:35:d7:46:30:4f:c8:a9:48:ec:36:48:71:81:e2:0dCertificate

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

83:0b:bc:9e:5b:23:d2:03:54:22:ef:8c:04:dc:ca:59:c7:da:18:3bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1024B - Virtual size: 668B

.pdata Size: 512B - Virtual size: 96B

INIT Size: 512B - Virtual size: 304B

23:a1:f9:dd:52:5e:fd:85:30:3f:63:e8:86:0f:e4:57
Certificate

4c:35:d7:46:30:4f:c8:a9:48:ec:36:48:71:81:e2:0d
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

83:0b:bc:9e:5b:23:d2:03:54:22:ef:8c:04:dc:ca:59:c7:da:18:3b
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 668B

.pdata
Size: 512B - Virtual size: 96B

INIT
Size: 512B - Virtual size: 304B