207d0d8f0c66ccb4b963bd95499eb930N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

207d0d8f0c66ccb4b963bd95499eb930N.exe
Size

70KB
MD5

207d0d8f0c66ccb4b963bd95499eb930
SHA1

6a9647eb84c37ce150c7df760e30d396ff1fdf8e
SHA256

32c7fd2e90a88a67c58218bbd72428c7543edc4425f6af041b58c1032c441605
SHA512

1c604be8d9285c62740fb399451389fa2d46054361b6d5229601da7d79feab9cc534436c3571abd2eaf3800175f384483cb3911501d196411d9d4ce6ad0302e6
SSDEEP

1536:GhED+M1tdtBrLpzQ0XH0r0c1kNaaC1YAMs8zTI:GARBrLpzQi0r31PvBMLo

Score

1^/10

Malware Config

Signatures

Files

207d0d8f0c66ccb4b963bd95499eb930N.exe
.sys windows:10 windows x64 arch:x64

582170932e58b5757f7fb9973c60b1e0

Code Sign

33:00:00:00:f3:15:8e:a5:7d:1c:55:9f:29:00:00:00:00:00:f3
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/01/2023, 19:14

Not After

15/12/2023, 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:64:8a:df:18:f4:f3:4a:fd:d9:a8:8d:0f:44:02:c3:e0:6c:59:ee:8f:3e:a9:de:61:43:5b:7b:7d:ef:a7:e0
Signer

Actual PE Digest

16:64:8a:df:18:f4:f3:4a:fd:d9:a8:8d:0f:44:02:c3:e0:6c:59:ee:8f:3e:a9:de:61:43:5b:7b:7d:ef:a7:e0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

\\172.10.2.118\CLDriver2\Bin\Win\win7\amd64\mvFrameGrabber.pdb

Imports

ntoskrnl.exe

PsTerminateSystemThread
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
_vsnwprintf
wcsncpy
wcsrchr
wcsstr
RtlUnicodeStringToInteger
RtlCompareMemory
ExAllocatePool
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
PsCreateSystemThread
IoAllocateMdl
IoFreeMdl
MmUnmapIoSpace
ZwCreateKey
ZwEnumerateValueKey
ZwQueryKey
PsGetCurrentProcessId
RtlNtStatusToDosError
ObReferenceObjectByName
__C_specific_handler
IoDriverObjectType
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ObQueryNameString
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
_vsnprintf
mbstowcs
IoReportTargetDeviceChangeAsynchronous
KeBugCheckEx
MmMapIoSpace
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlCopyUnicodeString
KeWaitForSingleObject
KeDelayExecutionThread
RtlIsNtDdiVersionAvailable
RtlInitUnicodeString

hal

KeStallExecutionProcessor
KeQueryPerformanceCounter

wdfldr.sys

WdfVersionUnbind
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

582170932e58b5757f7fb9973c60b1e0

Code Sign

33:00:00:00:f3:15:8e:a5:7d:1c:55:9f:29:00:00:00:00:00:f3Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

16:64:8a:df:18:f4:f3:4a:fd:d9:a8:8d:0f:44:02:c3:e0:6c:59:ee:8f:3e:a9:de:61:43:5b:7b:7d:ef:a7:e0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

wdfldr.sys

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 4B

PAGE Size: 10KB - Virtual size: 10KB

INIT Size: 3KB - Virtual size: 2KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 52B

33:00:00:00:f3:15:8e:a5:7d:1c:55:9f:29:00:00:00:00:00:f3
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

16:64:8a:df:18:f4:f3:4a:fd:d9:a8:8d:0f:44:02:c3:e0:6c:59:ee:8f:3e:a9:de:61:43:5b:7b:7d:ef:a7:e0
Signer

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 4B

PAGE
Size: 10KB - Virtual size: 10KB

INIT
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 52B